Logseq: Private, Open-Source Outliner for Notes and Knowledge (GitHub, Scanned)

Logseq is a note-taking app built around an outliner. Every line is a block you can link, reference, tag and query, and each day opens on a journal page, so writing first and organising later comes naturally. Links work in both directions, a page shows everywhere it was mentioned, and a graph view shows how your notes connect. It runs on Windows, macOS, Linux, iOS and Android, with a plugin API and a large set of community plugins and themes.

It is privacy-first: your notes live on your own device and no account is needed. The design draws on Roam Research, Org mode, TiddlyWiki and Workflowy, and the project is AGPL-3.0 with 363 contributors and about 45,000 stars, at 2.0.2 when scanned.

The project is part-way through a big change. A new database version stores graphs in SQLite and adds real-time collaboration, and the README says it is in beta (with the new mobile app and collaboration in alpha) and that data loss is possible, so it recommends automated or regular backups. If your notes matter, keep backups whichever version you use.

• Repository: github.com/logseq/logseq
• Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
• Language: Clojure. Stars: 45.4K. Forks: 2,851. Last push: Oct 26, 2026.
• Scan: safe, Oct 26, 2026, commit a37eff1

Who it is for

Students, researchers and writers who keep daily notes and want them linked together, and people leaving Roam Research or Notion who want their notes in files on their own disk.

Getting started

1. Linux, per-user install with no root needed

curl -fsSL https://raw.githubusercontent.com/logseq/logseq/master/scripts/install-linux.sh | bash -s -- --user

2. Linux, system-wide install (uses sudo)

curl -fsSL https://raw.githubusercontent.com/logseq/logseq/master/scripts/install-linux.sh | bash

On Windows and macOS, download the installer from the GitHub releases page; the web version is at app.logseq.com and the mobile apps are in the app stores. The Linux script is the same file the scan lists; the --user variant adds ~/.local/bin to your PATH in ~/.bashrc.

Safety scan

We cloned logseq/logseq at commit a37eff1 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets and no bare-IP URLs. The one pattern hit is the web app's Dockerfile installing Node.js with NodeSource's curl | bash setup script, a common way of building a container image that never runs on your machine.
• Installers: scripts/install-linux.sh (353 lines) downloads the release from GitHub, uses sudo for a system-wide install and, with --user, appends a PATH line to ~/.bashrc. deps/db-sync/start.sh is the sync server's development launcher, which points at AWS Cognito for sign-in. The postinstall hook in resources/package.json runs electron-builder's install-app-deps to rebuild native modules for Electron.
• 7 committed binaries: six builds of logseq-i18n-lint in bin/ (Linux, macOS and Windows, x86-64 and ARM), a translation checker used during development and built from Logseq's own logseq-i18n-lint Rust repository by the update-i18n-lint.yml workflow, plus the Android Gradle wrapper jar. None ships in the app.
• 386 known advisories across 13 pnpm lockfiles, 8 of them critical. Most sit in build and test tooling and in the sync server's dependencies (deps/db-sync). The critical one closest to users is Capacitor 8.3.1, the runtime of the mobile apps, with an advisory about remote content loading at the app's origin.
• 24 workflows. One uses pull_request_target (pr-labeler.yml); it runs actions/labeler on the branch name and does not check out the pull request. 1 of 92 third-party actions is pinned to a commit. Contributing guide and code of conduct present; no security policy or Dependabot. OpenSSF Scorecard 3.7 of 10.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: JSON 45.8K, JavaScript 37.2K, Markdown 23.5K, CSS 21.7K, TypeScript 7,466, Swift 5,972.

Questions

Is Logseq free?

Yes. Logseq is free and open source under AGPL-3.0, on desktop, web and mobile, with no account required. Development is supported by sponsors and backers on Open Collective.

Where does Logseq store my notes?

On your own device. The classic version keeps plain Markdown (or Org) files in a folder you choose. The new database version stores each graph in SQLite, and the README recommends turning on automated backups or making regular SQLite backups while it is in beta.

Logseq or Obsidian?

Both keep notes on your own disk and support two-way links. Logseq is open source and outliner-first, with every line a block and a daily journal at the centre. Obsidian is closed source and page-first, editing whole Markdown documents. Pick Logseq if you think in bullet points or want code you can read.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.