rekall

Rekall is designed as a 100% local, privacy-first tool, storing no API keys or passwords. File permissions for the SQLite database are securely set to 0o600. Outbound network access for semantic embedding model download, source enrichment, and link rot checks is opt-in or clearly indicated. A minor, localized SSRF risk remains in one URL validation path (`validate_url_simple`), although partially mitigated by explicit block patterns. The lack of default encryption for the SQLite database is a design choice for simplicity but is noted as an optional enhancement. Archive import now includes robust checks against zip-bombs and oversized files. CI/CD includes dependency scanning (pip-audit, gitleaks).