Install AariaSec

AariaSec runs entirely on your own machine. There is no account, no cloud plane, and no telemetry of prompt or response content — detection happens locally and what leaves your network is nothing unless you explicitly opt in.

Downloads and checksums: aariasec.com

Before you start

Verify what you downloaded. Every build ships a .sha256 sidecar.

# macOS / Linux
shasum -a 256 -c <file>.sha256

# Windows
Get-FileHash <file> -Algorithm SHA256

Expect the first launch to be slow. Cold start takes one to three minutes while the detection engine loads its models — longer on a low-end CPU, because antivirus scans them on first read. The window appears when the stack is ready, not immediately. This is the single most common "did it work?" moment, so give it a minute before launching it a second time.

macOS

1. Open the .dmg and drag AariaSec to Applications.
2. Launch it. The app is signed and notarized, so Gatekeeper should not object.
3. On first run you will be asked to trust a local certificate authority. This is required — see why below.
4. A shield appears in the menu bar. That is the control point: it shows status and carries Quit.

Windows

1. Run AariaSec-<version>-windows-amd64-Setup.exe.
2. The installer is not yet code-signed, so SmartScreen will warn. Verify the SHA-256 above before clicking through — that check is worth more than the warning it replaces.
3. Launch from the desktop shortcut or Start Menu.
4. The tray icon may be hidden. Windows 11 puts new tray icons in the overflow flyout by default — click the ^ chevron next to the clock. The shield is there; it is not missing.

Linux

One package format today: .deb, for amd64 and arm64.

sudo dpkg -i aariasec_<version>_amd64.deb # Debian / Ubuntu
sudo dpkg -i aariasec_<version>_arm64.deb # arm64

Fedora, RHEL and a portable build are not published yet. On an RPM distribution the .deb contents can be extracted manually, but that is unsupported and we would rather you told us you need an RPM than fought one into place.

A user service starts the proxy on login. Logs go to journalctl --user.

Why a certificate

To see what an agent does, AariaSec sits inline on its HTTPS traffic. That requires terminating TLS for known LLM endpoints, which requires a certificate authority your machine trusts. AariaSec generates that CA locally, per machine — the private key never leaves it and is never transmitted.

Two things follow, and both matter:

• Routing is never enabled before trust. If the CA is not trusted, AariaSec refuses to set proxy environment variables. Setting them first is what breaks pip, npm and git, so the order is deliberate.
• Only known LLM endpoints are decrypted. Everything else is tunnelled untouched. Your banking session is not inspected.

Confirm it is working

Open the dashboard. Under Discovery you should see the AI applications found on your machine. Run any AI tool — a coding assistant, a chat client — and events should appear within a second or two.

If nothing appears, see Troubleshooting. The most common cause is that monitoring was never armed, not that detection failed.

Removing it

See Uninstall. Read it before you remove anything by hand: AariaSec sets proxy environment variables, and removing the app without clearing them leaves your terminal pointed at a proxy that no longer exists.