rikkahub

Least-privilege permissions

• Grant RikkaHub only the app permissions it absolutely needs (camera, contacts, storage) and deny any unnecessary requests—treat permission prompts with suspicion
• Store API keys and passwords in Android's secure storage system (Keystore) rather than plain text files; verify RikkaHub documentation confirms this practice
• Restrict which user accounts on your device can access RikkaHub, and use a separate device or profile for sensitive work if handling confidential information

Network isolation

• Use a VPN or corporate firewall to inspect traffic from RikkaHub to LLM providers, ensuring data isn't leaking to unexpected destinations
• Avoid using RikkaHub on public WiFi without a VPN—credentials and prompts can be intercepted by attackers on the same network
• Regularly review which LLM providers (OpenAI, Anthropic, local servers, etc.) RikkaHub is configured to connect with, and disable any you don't actively use

Monitoring

• Check device logs weekly for unusual activity from RikkaHub, such as unexpected network connections, battery drain, or repeated crashes (signs of malicious behavior)
• Set alerts on your LLM provider accounts (OpenAI, Google Cloud, etc.) for unusual API usage patterns—a compromised RikkaHub could burn through your quota or budget
• Review RikkaHub's recent updates and security advisories; disable auto-updates and manually verify changes before installing if you handle sensitive data

Red flags to watch for

• Avoid using RikkaHub for highly confidential prompts (trade secrets, personal health data, financial records) until it gains wider adoption and independent security audits
• Be cautious if RikkaHub requests permissions unrelated to its core function (like access to SMS, call logs, or location) or shows unexpected network traffic
• Do not reuse the same API keys across multiple apps or services—if RikkaHub is compromised, attackers gain access only to that one credential, not your entire account ecosystem