Please report security problems privately, not in a public issue: use GitHub's Report a vulnerability button on the repository's Security tab (https://github.com/fus3r/lemma/security/advisories/new). Describe the problem and how to reproduce it; you will get an answer as soon as possible.

Lemma runs code only when you ask it to (Python cells you run in the Lab, the assistants' command-line tools when you ask a question), reads PDFs with Apple's PDFKit and renders mathematics in WebKit with a strict content security policy. Reports about any of these paths, about files Lemma writes, or about its Chrome companion are welcome.