Audited claim of not sending actual data to elsewhere

[vietnguyengit]

Hi, first of all, thank you for creating this project and make it open-source;

I read through this page:

https://docs.getwren.ai/concept/security

There is this claim:

Notably, users can trust that their database contents are never transmitted to the Language Learning Model (LLM). Instead, only metadata such as schemas, documentation, and queries are utilized in semantic search operations.

WrenAI strictly adheres to a read-only policy for data, ensuring that no sensitive information is stored or transmitted unnecessarily. In instances where data preview is required, queries are submitted on-demand, and no preview data is retained within WrenAI's database or storage systems, reinforcing user privacy and data integrity.

To many it's gonna be like a random guy on Reddit saying trust me bro; this against trust no one principle.

And I know some gonna says, it's open-source, you can inspect the code. True, but not true at the same time; it takes time and effort to look into every corners of the existing code, and being open-source doesn't automatically mean the app is safe. Remember the Dirty COW

My suggestions for you when dealing database connection nature are:

• have security check actions implemented to GitHub repository for scanning vulnerabilities.
• have reliable third-party auditing the code every 6 months or annually, audit reports should be publicly available and verifiable.

[chilijung]

Hi @vietnguyengit,

Thank you for the suggestions. We will be enabling a vulnerability check for GitHub scanning shortly. In the meantime, all of our source code is open source, so it is fully transparent to the community. @wwwy3y3 will follow up with the vulnerability check enablement.

In regards to third-party auditing, we plan to go through a SOC2 report this year and will follow up with related information with the community soon!

[wwwy3y3]

Hi @vietnguyengit we have enabled all the items on GitHub security, including code scanning & dependabot alerts. We'll keep an eye on the alerts.