Project Hub stores everything locally on your machine (or wherever you point db_path and docs_root):
| Data | Location |
|---|---|
| Projects, contacts (name, role, email, phone, company, notes), notes, active project selection | SQLite database db_path |
| Markdown copies of notes and file attachments | docs_root |
| Knowledge documents, custom project types, reports, exports, configuration | ~/.project-hub/ |
The data is stored unencrypted in normal files. The access rights of your user account and file system apply. Contacts and notes contain personal data of third parties, and you are responsible for processing it lawfully.
/project-hub:setup downloads the Python packages once via pip.cdn.jsdelivr.net when opened in the browser. Browser and CDN exchange the usual connection data, project content does not travel over this connection.~/.ssh/ or ~/.aws/) are rejected so credentials do not end up in a project folder by accident.The knowledge document tools validate only the topic (topic): it must not lead out of the project type's folder. The project type (project_type), by contrast, is appended unvalidated as a folder name to the knowledge directory, and the folder is created on every call, including read-only calls. A project type containing path separators or .. can therefore point to directories outside the knowledge directory. In normal operation the type comes from your projects or the type list. Do not pass on unchecked type names from third-party sources, such as imported projects.
tool_delete_project, or overwrite on import) removes data and the docs folder without a recycle bin.Do not report vulnerabilities publicly. Use the private vulnerability reporting of the GitHub repository markus-michalski/project-hub.