Security

Effective 21 September 2026 · Applies to the Gleam desktop app for Windows and to this website.

Found a problem? Please email mwaibryn@gmail.com with "Gleam security" in the subject. Tell us privately first and give us a fair chance to fix it before you share it with anyone else.

1. How to report

• Say which Gleam version you have (the installer file name includes it, for example 0.1.0) and which version of Windows.
• Describe what you found, the steps to reproduce it, and what someone could do with it.
• Do not include real API keys, your own or anyone else's. If a key may have leaked, revoke it with its provider first.

We aim to reply within 5 working days and to tell you what we will do and when. We are glad to credit you when the fix ships, if you would like that. There is no paid bug bounty.

2. What is in scope

• The Gleam desktop app and its installer, as downloaded from this website.
• This website, brn-mwai.github.io/gleam.

Out of scope: the AI and voice services Gleam connects to (Anthropic, OpenAI, NVIDIA, Groq, Fish Audio), GitHub itself, and problems that need someone to already control your Windows account. Please report issues with those services to them directly.

Please test only on your own computer and your own accounts. Do not access other people's data, and do not run tests that degrade services for others.

3. How Gleam is built to be safe

• Your keys: sealed with Windows DPAPI in %APPDATA%\Gleam, so only your Windows user account can unseal them. They are never written in plain text and never sent anywhere except to the service they belong to.
• No listening service: the app opens no network port and accepts no incoming connections. It only makes outgoing requests to the services you connect.
• No accounts, no servers: we run no backend, so there is no account of yours for anyone to break into and no database of users to leak.
• You approve risky actions: anything that sends, posts, deletes, buys, installs or deploys waits for you to press Allow, and every action Gleam takes on your computer is written to a journal you can read.
• No automatic updates: Gleam never downloads or installs code by itself. New versions come only from this website, when you choose to install them.
• Installs per user: the installer needs no administrator rights and writes only to your own user folders.

4. Check your download

Download Gleam only from this website. Each release lists the SHA256 checksum of its installer. To check yours, open PowerShell in your Downloads folder and run:

Get-FileHash .\Gleam_0.1.0_x64-setup.exe -Algorithm SHA256

The result must match the checksum on the download card exactly. If it does not, delete the file and tell us. The installer is not yet code-signed, so Windows SmartScreen may warn you the first time; the checksum is how you confirm the file is ours.

5. This website

This site is static HTML served by GitHub Pages over HTTPS. It sets no cookies, has no forms and loads no scripts, fonts or analytics from anyone else.