Please report privately via GitHub Security Advisories rather than a public issue. I'll acknowledge within a few days.

Worth knowing when judging a report's impact:

• Reads other processes. It walks the kernel process table for provider arguments, environments, listening sockets, memory footprint and mapped model files. Same-user processes only — it holds no elevated privileges and asks for none.
• Runs one external program. ~/.lmstudio/bin/lms ps --json, LM Studio's own CLI, because its last-use time exists nowhere else. A fixed path, never a PATH lookup, killed on a 5-second deadline. Everything else is HTTP to localhost and kernel reads.
• Stores one secret. A manually entered API key — today only LM Studio's, since it keeps a hash and can't be detected. In the signed release this lives in the data-protection Keychain. In an unsigned or ad-hoc build it falls back to plaintext UserDefaults, because that build has no Keychain entitlement. If you build from source rather than installing a release, your key is on disk in the clear.
• Can end processes. Ejecting from koboldcpp sends SIGTERM to its server, because it has no unload endpoint. Every other provider is asked over HTTP.
• Talks to the network only for updates. GitHub's releases API, to compare version numbers, and only while update checks are enabled. Nothing is ever sent anywhere.

Detected ports and API keys are deliberately not persisted — they're re-derived from the machine every second, so there's no stale copy on disk to leak.