> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security practices

Anaconda Desktop is designed with security in mind. Use the resources below to report vulnerabilities and learn about Desktop's default security model.

## Reporting security issues

If you discover a security vulnerability in Anaconda Desktop, report it through Anaconda's [Vulnerability Disclosure Program](https://app.intigriti.com/programs/anacondainc/anacondavdp/detail) on Intigriti.

## Security model

The following describes Desktop's default security model:

* **Least privilege**: Desktop follows the principle of least privilege, which means it only uses the permissions required for normal operation. All processes run under your standard user account without requesting administrator or root access, limiting the potential impact if any component is compromised.
* **Encrypted credentials**: OAuth tokens are stored using OS-native encrypted secure storage.
* **Session security**: Signing out clears all session tokens from memory.
* **Data privacy**: App usage and performance data is anonymized.
  <Tip>To disable telemetry entirely, go to [Settings](/docs/anaconda-desktop/settings) and turn off **App Settings**.</Tip>
* **Network isolation**: The Desktop API server binds to `127.0.0.1` by default and requires authentication. This means the API is only reachable from processes on your own machine and is never exposed to a local network or the internet.