Skip to content

Security: CodingIsCool666/attentrix

SECURITY.md

Security Policy

ATTENTRIX is a local research beta that analyzes a user-selected Zoom gallery. Security and privacy reports are welcome, especially when they concern local file access, upload handling, model-artifact integrity, loopback isolation, or unexpected capture or transmission of meeting data.

Supported Versions

Version Status
ATTENTRIX 0.2.0-beta.6 for Windows x64 Current public beta; security fixes are evaluated here first
Unreleased source on main Best-effort review; identify the commit in every report
Beta 1 through Beta 4 packages Superseded or withdrawn from active use
Live v21 / classroom_v6_signalroom_live_v21 Retired; it will not receive fixes or be restored
macOS builds Not publicly supported until physical smoke testing, signing, and notarization pass

Only the beta.6 installer and portable archive with the published SHA-256 values are within the current Windows review boundary. Beta.6 is unsigned, so hash verification remains required. See the Windows security review.

0da9d21e13e0f310898e1aca6dc3d7634222cb7b7da7a1ca6a55b7696fad486c  ATTENTRIX-Setup-0.2.0-beta.6-x64.exe
5481934141d307684294eb78cf0da308cb554eb0958fff9198859975820f13c8  ATTENTRIX-Windows-x64-0.2.0-beta.6.zip

The beta.6 release is not yet Authenticode-signed. Verify the hashes above before running either package.

Report A Vulnerability

Do not open a public issue for a suspected vulnerability or include participant data, recordings, credentials, exploit code, or sensitive logs in a public thread.

Use GitHub's private Report a vulnerability flow for this repository:

https://github.com/CodingIsCool666/attentrix/security/advisories/new

Include, where possible:

  • the affected version, commit, operating system, and installation method;
  • a concise impact statement and reproducible steps;
  • whether the issue crosses the loopback-only or local-storage boundary;
  • sanitized logs or a minimal proof of concept; and
  • any known mitigations or disclosure deadline.

If private vulnerability reporting is unavailable, contact the repository owner @CodingIsCool666 through a private channel and wait for confirmation before sharing details. Enabling and testing a durable private security contact is a required gate before this source repository may be made public.

What To Expect

Maintainers aim to acknowledge a complete report within seven calendar days, provide an initial assessment within fourteen days, and send progress updates at least every thirty days while a confirmed issue remains open. These are targets for a small research project, not service-level guarantees.

We will coordinate a disclosure date with the reporter after a fix or practical mitigation is available. Please allow a reasonable remediation window. This project does not currently operate a paid bug-bounty program.

Security Boundary

The reviewed production path binds to loopback and has no telemetry or cloud upload service. Saving a live replay is off by default. When enabled, replay can include shared window or tab audio from the selected source. The presenter may separately opt in to microphone capture; only that explicit choice triggers the browser permission prompt. ATTENTRIX never analyzes either audio source. A user-selected recording and an explicitly enabled live replay remain on that user's computer until deleted.

The packaged calibrator is a joblib artifact. Python serialization formats can execute code while loading, so never substitute an untrusted model file. Use only the hash-locked artifact shipped with an official build.

Security reports do not replace responsible-use and consent obligations. See the privacy notice for the data boundary.

There aren't any published security advisories