48 lines
1.4 KiB
Markdown
48 lines
1.4 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Version
|
|
|
|
Only the latest alpha release receives security fixes.
|
|
|
|
## Reporting
|
|
|
|
Do not open a public issue containing credentials, person data, message
|
|
content, host details, SteamIDs, screenshots, or exploit payloads.
|
|
|
|
Use the hosting platform's private vulnerability-reporting channel. Include:
|
|
|
|
- affected version and commit;
|
|
- reachable source-to-sink path;
|
|
- required attacker capabilities;
|
|
- impact;
|
|
- a minimal redacted reproduction;
|
|
- whether any credential or private data was exposed.
|
|
|
|
Do not include live API keys or production data. Revoke or rotate any exposed
|
|
credential before sending a report.
|
|
|
|
## Security Boundaries
|
|
|
|
- Plugins receive capability-limited SDK objects only.
|
|
- Command ownership freezes at startup.
|
|
- Extension artifacts require canonical digest and publisher verification.
|
|
- The isolated Host has no general network, home, device, or writable
|
|
filesystem access.
|
|
- GUI delivery is group-gated, serial, and visually confirmed.
|
|
- Runtime configuration and private context are outside Git with restrictive
|
|
permissions.
|
|
- Steam traffic is restricted to a configured loopback proxy with no direct
|
|
fallback.
|
|
|
|
## Release Hygiene
|
|
|
|
Before publishing:
|
|
|
|
```sh
|
|
PATH="$PWD/.venv/bin:$PATH" ./tools/check-local.sh
|
|
./tools/check-secrets.py --history
|
|
```
|
|
|
|
After a confirmed credential leak, history rewriting is not sufficient by
|
|
itself. Revoke or rotate the credential and invalidate dependent sessions.
|