NullTrace keeps the vault on the machine that runs it:

• Windows: %LocalAppData%\nulltrace (vault), %AppData%\nulltrace (config)
• Linux / macOS: ~/.local/share/nulltrace (vault), ~/.config/nulltrace (config), or under $XDG_DATA_HOME / $XDG_CONFIG_HOME if you set them

The vault is encrypted. Do not attach vault.db, config.yaml, daemon.token, or a passphrase file to an issue or a pull request.

By default, almost nothing. Optional features that talk to the network:

• Password dump checks send a 5-character SHA-1 prefix to the public Pwned Passwords range API. The rest of the password stays local.
• Scan matches your identity against a local broker catalog. It does not scrape the open web unless you turn extra tools on.
• Email send uses the SMTP account you paste in. That is your mailbox, not a NullTrace server.

Browser automation and CapSolver are off until you enable them.

Please use GitHub's private vulnerability reporting on this repository (Security tab, then "Report a vulnerability"). Include the version (nulltrace --version or git rev-parse --short HEAD) and enough to reproduce. Do not open a public issue for a vault-bypass or crypto bug.