N0X's private-document path combines local extraction, content-addressed retrieval, and filename/chunk citations. Browser isolation, dedicated workers, sandboxed iframes, a Content Security Policy, COOP/COEP headers, and API request controls are layered guardrails—not proof that a model answer or generated program is safe or correct.
| Surface | Boundary | Main risk | Mitigation |
|---|---|---|---|
| IndexedDB | Conversations and document chunk/vector cache data stay in the browser origin. Memories are saved and retrieved only while Memory is enabled. | Any same-origin XSS could read local app data. Browser profile compromise is also out of the app's control. | Storage failures are announced without echoing content. Clear controls remove each owned database, but browser storage is not a defense against same-origin script. |
| RAG identity and deletion | A local SHA-256 digest of file bytes keys vector records and deduplicates identical content. Removing or clearing waits for IndexedDB to commit before updating the UI. | Cached chunks include extracted document text. A browser can evict records, and an exact commit/ack failure can still require a retry or reattachment. | Legacy metadata-derived cache keys are purged on schema upgrade. RAG timeouts terminate the worker so it cannot continue a reported-failed mutation in the background. |
| sessionStorage keys | Cloud API credentials are kept in sessionStorage, not localStorage or IndexedDB. | sessionStorage is still readable by same-origin JavaScript during the active session. | Treat extensions and pasted scripts as part of your trust boundary. Crash and session-restore retention depends on the browser. |
| Generated Markdown | Remote images are blocked by default. External links require a click and open with noopener/noreferrer. | After Load once, the image host receives a network request and can observe connection metadata. Links can lead to untrusted sites. | Each remote image needs a per-image approval and then loads without cross-origin credentials or a referrer. The UI shows the destination host before approval. |
| Artifact iframes | Generated HTML previews run in opaque-origin sandboxed iframes. Their embedded CSP sets connect-src 'none' and blocks forms, frames, objects, and non-data media. | Previewed code can still run JavaScript, consume CPU or memory, render deceptive content, or attempt to navigate its own frame to an external destination. | Artifacts get no same-origin access to N0X, and the CSP blocks ordinary subresource and connection paths. This is not a zero-network guarantee; review code before previewing or copying it. |
| Providers and API routes | Cloud and remote Ollama use configured endpoints. Deep Search uses N0X server routes before third parties. Auto-routing can select Cloud. | Prompts, enabled context, or search queries leave the device on their selected path. Providers have their own retention and security terms. | Provider and privacy badges expose the path. Server routes reject reported cross-site browser calls and enforce bounded inputs, outbound allowlists, deadlines, and best-effort rate limits; this is not user authentication. |
| Opt-in analytics | Vercel page views and N0X funnel events are disabled until the user explicitly allows them in the consent banner or Privacy settings. | When enabled, sanitized paths, attribution, event names, allowlisted coarse metadata, and ordinary request/service metadata leave the device. | Prompts, responses, documents, file names, API keys, and memory content are excluded. Non-attribution query values and fragments are removed from page views. |
| Content Security Policy | A CSP restricts framing, objects, base URLs, forms, and resource origins. | WASM and supported runtimes still require inline/eval script modes and broad configured connection targets. | CSP is defense in depth, not an isolation guarantee. Artifact iframes remain sandboxed without same-origin access. |
HTML and JavaScript previews run in opaque-origin sandboxed iframes whose CSP blocks ordinary network subresources and connections, but same-frame navigation remains a residual network path.
Deep Search and analytics use in-memory server-side rate limits. These limits are best-effort on serverless deployments, reset independently per instance, and should be replaced or backed by shared edge/hosted limiting before serious scale.
Cloud API requests go directly from the browser to your configured OpenAI-compatible endpoint. Deep Search requests use N0X server routes before reaching third-party providers. Only use providers you trust with the prompt and enabled context you send. A loopback Ollama server stays on-device; a remote Ollama URL is a network provider.