release: public alpha 0.6.0 baseline

2026-10-15 03:58:31 +08:00
commit d4242ae07c
238 changed files with 37724 additions and 0 deletions
@@ -0,0 +1,47 @@
+# Security Policy
+
+## Supported Version
+
+Only the latest alpha release receives security fixes.
+
+## Reporting
+
+Do not open a public issue containing credentials, person data, message
+content, host details, SteamIDs, screenshots, or exploit payloads.
+
+Use the hosting platform's private vulnerability-reporting channel. Include:
+
+- affected version and commit;
+- reachable source-to-sink path;
+- required attacker capabilities;
+- impact;
+- a minimal redacted reproduction;
+- whether any credential or private data was exposed.
+
+Do not include live API keys or production data. Revoke or rotate any exposed
+credential before sending a report.
+
+## Security Boundaries
+
+- Plugins receive capability-limited SDK objects only.
+- Command ownership freezes at startup.
+- Extension artifacts require canonical digest and publisher verification.
+- The isolated Host has no general network, home, device, or writable
+  filesystem access.
+- GUI delivery is group-gated, serial, and visually confirmed.
+- Runtime configuration and private context are outside Git with restrictive
+  permissions.
+- Steam traffic is restricted to a configured loopback proxy with no direct
+  fallback.
+
+## Release Hygiene
+
+Before publishing:
+
+```sh
+PATH="$PWD/.venv/bin:$PATH" ./tools/check-local.sh
+./tools/check-secrets.py --history
+```
+
+After a confirmed credential leak, history rewriting is not sufficient by
+itself. Revoke or rotate the credential and invalidate dependent sessions.