Security Whitepaper

Version: 1.1 — August 2026

1. Introduction

Heliox OS is built to be the highly advanced, deeply integrated AI system control layer for your edge device, granting autonomous agents unprecedented access to system modules. Because of this power, rigorous security architecture is inherently critical.

2. Operating-System Credential Storage

Heliox stores API credentials through Windows Credential Manager, macOS Keychain, or a Secret Service-compatible Linux keyring. It does not fall back to a machine-derived application vault when that secure service is unavailable; credential operations fail closed instead. Secrets are redacted from application logs, but users remain responsible for the security of their operating-system account and configured third-party providers.

3. Agent Execution Sandboxing

Intelligent system agents present unique risks concerning code execution. Heliox layers deterministic controls around planned actions:

  • Permission tiers: Actions are classified from read-only through root-level risk, with confirmation gates for higher-risk operations.
  • Source-scoped authority: Interactive, autonomous, voice, gesture, background, and specialist sources have enforced permission floors and deny lists that task-level overrides can narrow but cannot widen.
  • Validation and review: Plans are schema-validated; risky plans can receive an independent critic review, simulation report, learned-risk warning, and explicit user confirmation.
  • Rollback boundaries: Snapshots are used where a supported backend exists. Required snapshots fail closed when unavailable; not every external or irreversible effect can be rolled back.

4. API Communication Security

When a user configures an external model or integration, the desktop daemon connects directly to that provider over its HTTPS API rather than through a Heliox-operated prompt proxy. Transport security, retention, authentication, regional processing, and availability are also governed by the selected provider. Local-only Ollama operation remains available for supported models and tasks.

5. Auditing and Verifiability

Heliox maintains local execution records plus separate HMAC-SHA256 hash-chained audit stores for security-sensitive decisions such as gateway and permission changes. These records improve tamper detection; they do not make a compromised machine trustworthy. The MIT-licensed source, threat boundaries, and implementation notes can be independently reviewed in the GitHub Repository.

6. Known Boundaries

Heliox is security-sensitive automation software, not a formally verified security boundary. Platform protections differ: the optional syscall guard is Linux-specific, desktop permissions require operating-system consent, browser and external-service effects may be irreversible, and hardware-dependent camera, microphone, gaze, gesture, or neural behavior requires testing on the user's device. Learned models can add caution but cannot remove deterministic warnings or grant authority.

7. Reporting Vulnerabilities

If you discover a vulnerability, use the repository's private security advisory form before creating a public issue. You may also contact the maintainer through the address on the GitHub profile.