I make Vellium, a free open-source app for roleplay and story writing with local models. Windows, macOS and Linux. The last release was only security fixes, and one of the bugs is worth knowing about even if you never use my app. When you imported a character card, Vellium saved the card's avatar field as the path to the avatar file. When you later changed that character's picture, it deleted the old file at that path. So a card with ../../ and some path in that field could make the app delete a file the card author picked, the moment you swapped the avatar. If the field held a web link instead, the author got your IP every time the card loaded, same as a tracking pixel in an email. Every version from 0.2.3 to 1.6.0 has this. If you're on anything older than 1.7, update. Cards can't set the avatar path anymore, and the app checks any stored path before deleting a file. I only checked my own code, so I can't say whether other frontends have the same bug. A card is still a file from a stranger and any field in it can contain anything, so if you build a frontend it's worth a look. The other big one: Vellium's local server answered requests that came through any domain pointing at your machine. That's DNS rebinding, and it means a website open in your browser could talk to the app's server. On top of that, the settings endpoint returned TTS and STT API keys unmasked. Both are fixed in 1.7. The smaller fixes from the same pass are in the first comment, for anyone who builds this kind of thing. Now the part for people who haven't run a local model yet, since that's mostly who I build this for. On first launch Vellium asks what you've got. If you already have llama.cpp or some GGUF files lying around, it finds them and starts the server itself. If you have nothing, it downloads llama.cpp and a model sized for your GPU and RAM. If you'd rather use an API, there are presets for OpenRouter, OpenAI and a few others, and you paste a key. LM Studio, Ollama and KoboldCpp work too if you already run one of them. The simple interface is the default. You can get replies without knowing what a sampler or a prompt template is, and all of that sits in settings for when you get curious. Besides chat there's a writing mode for longer stories (it imports DOCX), lorebooks with SillyTavern World Info import, a voice mode with bundled speech models, and experimental animated avatars in the Inochi2D format. The builds aren't signed, so Windows SmartScreen will warn you (More info → Run anyway) and macOS will want "Open Anyway" in System Settings → Privacy & Security. If you tried it before, the bigger changes since 1.1: it talks to llama-server directly: shows what's loaded and which slots are busy, and loads or unloads models when llama-server runs in router mode a context view that shows the exact next prompt and how many tokens each part takes, and lets you leave messages out of context without deleting them sampler presets that load automatically for a specific model separate profiles with their own database, and backups you can encrypt with a password Repo and downloads: https://github.com/tg-prplx/vellium If you set it up as your first local thing and some onboarding step confused you, tell me which one. That's the part I most want to get right.   submitted by   /u/Possible_Statement84 [link]   [comments]