by xprivo
xPrivo is the privacy-first AI assistant that you can self-host. No accounts, never. Free as in freedom.
# Add to your Claude Code skills
git clone https://github.com/xprivo/ai-chatLast scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@xmldom/xmldom: xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "dompurify: DOMPurify contains a Cross-site Scripting vulnerability",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "exceljs: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
"severity": "high"
},
{
"type": "npm-audit",
"message": "jspdf: jsPDF has a PDF Object Injection via FreeText color",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tar: tar has Hardlink Path Traversal via Drive-Relative Linkpath",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
"severity": "high"
},
{
"type": "npm-audit",
"message": "underscore: Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-05-30T16:30:04.382Z",
"npmAuditRan": true,
"pipAuditRan": true
}No comments yet. Be the first to share your thoughts!
xPrivo is an open-source AI chat interface and an alternative to ChatGPT/Perplexity that prioritises privacy and control. Chat with xPrivo or any local or external AI model by adding your own API keys. Organise your conversations in workspaces and keep everything local and private. No account is required! Plug-and-play architecture.
By default, most AI assistants use your chats for training and analysis. Even if you opt out of training, your chats will still be anonymised and used for analytics, so you lose control of your valuable thoughts, business ideas and more. By default, xPrivo is private and log-free. You can stay fully worry-free.
Try it now at xprivo.com - Use our pre-configured xPrivo model. We use trusted EU-based partners and the best model for your requests, such as GPT-OSS, Mistral 3, DeepSeek V3.2 or Llama, all of which have a zero-logging guarantee. You can also add your own AI providers with custom API keys or self-host for complete control.
Hosted Solution Benefits:
Free Tier: Daily request quota with occasional non-personalized, non-intrusive ads from vetted partners. Web access.
PRO Upgrade: Unlimited daily requests and ad-free experience
Privacy-First Authentication: No account creation required. You receive a unique license key that serves as your identifier while keeping all chat history exclusively on your local device
Become a Sponsor / Gain visibility on xPrivo
Support xPrivo to help us keep the service free and reach our user base through carefully selected, non-personalized, non-intrusive advertising. Gain visibility within our community without compromising privacy or user experience.
Learn more about sponsorship / advertising.
Big sponsors:
xPrivo is designed for users who want a powerful AI chat experience without compromising on privacy:
Whether you're a developer, researcher, or privacy-conscious user, xPrivo provides a clean, modern interface for interacting with AI models on your terms.
Simply visit xprivo.com and start chatting.
You can then also connect to other AI providers:
https://api.aiprovider.com/v1/chat/completions)Bearer sk-...)llama-3.3, deepseek)Note: When using xprivo.com with certain AI providers, you may need to set up a proxy server to handle CORS. See the Backend Proxy Setup section below.
Prerequisites:
Installation:
# Clone the repository
git clone
cd xprivo-ai-chat
# Install dependencies
npm install
# Start development server
npm run dev
The app will open at http://localhost:5173
Configure your default AI provider in src/config/setup.ts:
defaultProvider: {
name: 'Your Provider Name',
url: 'https://api.yourprovider.com/v1/chat/completions',
authorization: 'Bearer your-api-key-here',
model: 'llama-3.3-70b',
enableWebSearch: false,
enableSafeWebSearch: true
}
Important: When running locally and calling external endpoints, you may encounter CORS issues with some AI providers. See the Backend Proxy Setup section to resolve this.
Some API providers (like Openrouter, etc.) may block direct API requests from your browser due to CORS (Cross-Origin Resource Sharing) restrictions. If you encounter CORS errors, you'll need to proxy requests through your own server. You could set this up with a lightweight Node.js proxy server with an OpenAI-compatible endpoint structure.
Once your "middleman" proxy server is running, you can do the following in the frontend:.
In the chat interface, go to Settings > Configure AI Models & Endpoints and add:
http://localhost:3001/chatBearer dummy - auth is handled by proxy)llama-3.3 (or your chosen model)You need to route the models to the correct AI provider in the backend.
Modify API request parameters globally in src/config/setup.ts:
apiRequestConfig: {
temperature: 0.7,
max_tokens: 2000,
max_completion_tokens: 4000,
// ... other parameters
}
Note: These settings apply to all models in your configuration.
App Name: Edit translations in src/translations/index.ts
Logo: Update menu_icon path in src/config/setup.ts and sidebar logo
Colors: Modify tailwind.config.js for custom color schemes
Change the assistant's profile picture:
Adjust maximum file size in src/utils/fileProcessor.ts:
const maxSize = 10 * 1024 * 1024; // 10MB default
Add new languages in src/translations/index.ts by including all required translation keys.
npm run build
The optimized build will be in the dist/ folder, ready for deployment to any static hosting service (Vercel, Netlify, etc.).
/v1/chat/completions).See the Backend Proxy Setup section above to proxy requests through your own server.
This project is licensed under the AGPLv3 License - see the LICENSE file for details.
If you find xPrivo useful, please star this repository and report any bugs or suggest new features via the Issues tab. You can also share it with others who value privacy.
Built with ❤️ for the privacy-conscious community.