ATTENTRIX is a local research beta that analyzes a user-selected Zoom gallery. Security and privacy reports are welcome, especially when they concern local file access, upload handling, model-artifact integrity, loopback isolation, or unexpected capture or transmission of meeting data.
| Version | Status |
|---|---|
ATTENTRIX 0.2.0-beta.6 for Windows x64 |
Current public beta; security fixes are evaluated here first |
Unreleased source on main |
Best-effort review; identify the commit in every report |
| Beta 1 through Beta 4 packages | Superseded or withdrawn from active use |
Live v21 / classroom_v6_signalroom_live_v21 |
Retired; it will not receive fixes or be restored |
| macOS builds | Not publicly supported until physical smoke testing, signing, and notarization pass |
Only the beta.6 installer and portable archive with the published SHA-256 values are within the current Windows review boundary. Beta.6 is unsigned, so hash verification remains required. See the Windows security review.
0da9d21e13e0f310898e1aca6dc3d7634222cb7b7da7a1ca6a55b7696fad486c ATTENTRIX-Setup-0.2.0-beta.6-x64.exe
5481934141d307684294eb78cf0da308cb554eb0958fff9198859975820f13c8 ATTENTRIX-Windows-x64-0.2.0-beta.6.zip
The beta.6 release is not yet Authenticode-signed. Verify the hashes above before running either package.
Do not open a public issue for a suspected vulnerability or include participant data, recordings, credentials, exploit code, or sensitive logs in a public thread.
Use GitHub's private Report a vulnerability flow for this repository:
https://github.com/CodingIsCool666/attentrix/security/advisories/new
Include, where possible:
- the affected version, commit, operating system, and installation method;
- a concise impact statement and reproducible steps;
- whether the issue crosses the loopback-only or local-storage boundary;
- sanitized logs or a minimal proof of concept; and
- any known mitigations or disclosure deadline.
If private vulnerability reporting is unavailable, contact the repository owner
@CodingIsCool666 through a private channel and wait for confirmation before
sharing details. Enabling and testing a durable private security contact is a
required gate before this source repository may be made public.
Maintainers aim to acknowledge a complete report within seven calendar days, provide an initial assessment within fourteen days, and send progress updates at least every thirty days while a confirmed issue remains open. These are targets for a small research project, not service-level guarantees.
We will coordinate a disclosure date with the reporter after a fix or practical mitigation is available. Please allow a reasonable remediation window. This project does not currently operate a paid bug-bounty program.
The reviewed production path binds to loopback and has no telemetry or cloud upload service. Saving a live replay is off by default. When enabled, replay can include shared window or tab audio from the selected source. The presenter may separately opt in to microphone capture; only that explicit choice triggers the browser permission prompt. ATTENTRIX never analyzes either audio source. A user-selected recording and an explicitly enabled live replay remain on that user's computer until deleted.
The packaged calibrator is a joblib artifact. Python serialization formats
can execute code while loading, so never substitute an untrusted model file.
Use only the hash-locked artifact shipped with an official build.
Security reports do not replace responsible-use and consent obligations. See the privacy notice for the data boundary.