AI model files come in several formats. Some are safe by design; others can execute arbitrary code when loaded. Understanding the difference is critical when downloading models from the internet.

Thumper-Run’s catalog exclusively uses safe formats (.safetensors, .gguf, .onnx). When you download models from third-party sources like HuggingFace or CivitAI, check the file format before loading.

Thumper-Run’s architecture defines five sync modes. Only modes marked as current below should be treated as released security capabilities.

Current public capabilities are local data controls and encrypted transport. Modes 3–5 remain gated for private E2EE. Relay-assisted deployment BeeKEM paths are server-assisted and do not provide a current relay-confidentiality guarantee. Forward secrecy and post-compromise security also remain planned.

API keys for services like HuggingFace, Ollama remote endpoints, or cloud LLM providers are stored in your operating system’s native keychain:

Key Security Guarantees

• Keys are never stored in plain text on disk
• Keys are never sent to Thumper-Run servers or any third party
• Keys are only used for direct API calls to the service you configured
• Keys are accessible only to the Thumper-Run process via the Tauri IPC layer

Rotating Keys

To rotate an API key, go to Settings → API Keys, delete the old key, and add the new one. The old key is immediately removed from the keychain. If you’re syncing across devices, API keys are not included in sync data — each device manages its own keys independently.

Where supported, Thumper-Run can use a recovery phrase for identity or key recovery. Its availability and scope depend on the product build and enabled workflow. A recovery phrase does not establish private E2EE for a current sync or deployment path.

What the Recovery Phrase Does

• May restore supported identity or key material
• May participate in supported device recovery or pairing flows
• Does not back up local apps, models, projects, or outputs

Storage Recommendations

• Write the 24 words on paper and store in a secure location
• Use a password manager’s secure notes feature
• Never store the phrase in an unencrypted file, email, or chat message
• Never share the phrase with anyone, including Thumper-Run support

Local-only data (apps, models, generated images) does not depend on the recovery phrase. Back up that data separately and verify what any export or recovery operation includes.

If you discover a security vulnerability in Thumper-Run, we appreciate responsible disclosure. Please report vulnerabilities privately so we can address them before public disclosure.

How to Report

• Email: security@thumper.ai
• Include a detailed description of the vulnerability
• Include steps to reproduce, if possible
• Include the version of Thumper-Run you’re using

Responsible Disclosure Policy

• We will confirm receipt after the security team has triaged your report
• We will provide an estimated timeline for a fix
• We will notify you when the fix is released
• We ask that you do not publicly disclose the vulnerability until a fix is available