desktop security

Practical, Bash-first Linux hardening guide for desktop AI: explains why AI apps expand the attack surface (supply chain, overscoped perms, data leaks, prompt injection, resource drains) and gives copy-paste steps to sandbox (Firejail/Flatpak/Podman), lock down egress (UFW/firewalld/nftables), manage secrets (pass/direnv), verify/isolate deps (checksums/pipx/containers), and cap devices/GPU/resources, plus a 5-minute safe-run playbook.