52 lines (37 loc) · 1.84 KB

한국어 | English

Security Policy

Supported Versions

Version	Support
Latest release	Supported
Previous versions	Not supported

Reporting a Vulnerability

If you discover a security vulnerability, please do not open a public issue. Instead, report it through one of the following methods:

GitHub Security Advisory: Report a vulnerability
Or contact us via private email

What to Include in Your Report

Vulnerability type (e.g., path traversal, injection)
Steps to reproduce
Scope of impact
Suggested fix, if possible

Response Process

Acknowledgment within 72 hours of receiving the report
Severity assessment followed by a shared fix timeline
Release and credit given after the fix is complete

Security Design

API Key Storage

AES-GCM encrypted file, key derived from hardware UUID + HKDF (device-bound)
Stored file permissions: 0o600 (owner read/write only)
Automatic migration from legacy macOS Keychain to encrypted file (V1 SHA256 → V2 HKDF)
No API key required when using Claude CLI (subscription-based authentication)

Network

HTTPS only (NSAppTransportSecurity)
API keys are transmitted only via HTTP headers (never in URL parameters)

File System

Path traversal prevention: URL.resolvingSymlinksInPath() followed by hasPrefix check
Folder name validation: sanitizeFolderName() — max 3 depth, 255 character limit, .. forbidden, null bytes removed
Wiki-link injection prevention: sanitizeWikilink() — [[, ]], /, \\, .. removed

Data Protection

YAML: tags are always stored as double-quoted arrays (tags: ["tag1", "tag2"])
File deletion: uses trashItem (recoverable deletion)
File writing: atomic writes via atomically: true option