lemonade

Least-privilege permissions

• Run Lemonade and local AI models with the minimum user account permissions needed—never use administrator or root access unless absolutely required.
• Restrict which users on your device can access and modify downloaded models and settings; keep model files in protected directories.
• Disable direct GPU hardware access for untrusted applications; only grant compute resource access to models you've explicitly approved.

Network isolation

• Run Lemonade on a separate network segment (or use a firewall rule) if possible, blocking unexpected outbound connections to the internet.
• Verify what data the AI models and Lemonade connector actually send over the network—check for hidden telemetry, licensing "phone home" calls, or auto-update requests.
• Use a proxy or network monitor to log and audit all traffic from local AI applications; block any transmissions you don't recognize.

Monitoring

• Set resource limits (CPU, GPU, memory, storage) on Lemonade processes so a runaway model cannot freeze or crash your device.
• Regularly check GPU and system performance during AI model runs; watch for unexpected spikes that suggest resource hogging.
• Keep logs of which models were downloaded, when they ran, and any errors—review them weekly for suspicious activity.

Red flags to watch for

• Models from unknown or unverified sources, or models whose creators don't publish detailed information about what the model does.
• Lemonade or models requesting unusual permissions (access to files, camera, microphone, or network you didn't expect).
• Performance degradation, unexpected network traffic, or system crashes shortly after installing or running a new model.
• Updates or patches that arrive without clear release notes or security advisories; avoid installing community optimizations that lack transparent documentation.