JWeBot/SECURITY.md

Security Policy

Supported Version

Only the latest alpha release receives security fixes.

Reporting

Do not open a public issue containing credentials, person data, message content, host details, SteamIDs, screenshots, or exploit payloads.

Use the hosting platform's private vulnerability-reporting channel. Include:

• affected version and commit;
• reachable source-to-sink path;
• required attacker capabilities;
• impact;
• a minimal redacted reproduction;
• whether any credential or private data was exposed.

Do not include live API keys or production data. Revoke or rotate any exposed credential before sending a report.

Security Boundaries

• Plugins receive capability-limited SDK objects only.
• Command ownership freezes at startup.
• Extension artifacts require canonical digest and publisher verification.
• The isolated Host has no general network, home, device, or writable filesystem access.
• GUI delivery is group-gated, serial, and visually confirmed.
• Runtime configuration and private context are outside Git with restrictive permissions.
• Steam traffic is restricted to a configured loopback proxy with no direct fallback.

Release Hygiene

Before publishing:

PATH="$PWD/.venv/bin:$PATH" ./tools/check-local.sh
./tools/check-secrets.py --history

After a confirmed credential leak, history rewriting is not sufficient by itself. Revoke or rotate the credential and invalidate dependent sessions.