Security

SECURITY.md

Security Policy

Reporting a Vulnerability

Report security vulnerabilities privately to methodwhite@proton.me.

Do not open public issues for security vulnerabilities.

Scope

Unsafe deserialization in loaders
Arbitrary code execution via crafted binaries
Memory safety issues
Exposure of sensitive data in logs

Response

Acknowledgment within 48 hours
Fix timeline depends on severity

Threat Model (Tier S++ §11)

Protected assets

Source and package integrity
License/entitlement enforcement
PyInstaller release artifacts and checksums
Daemon credentials (never committed)

Actors and trust boundaries

Untrusted input: any analyzed binary/sample
x402 client: consumes entitlements from x402-service; never trusts client IDs alone
GUI: never holds backend private keys or secrets

Primary threats

Malicious binary triggering code execution via a loader
License bypass / entitlement forgery
Secret leak from embedded config extraction or logs

Mitigations

Input validation in all loaders (8 formats)
make test gate + CI (ruff, pytest, CodeQL, gitleaks)
Feature gates enforced by license server, fail-closed on ambiguity
Release checksums for artifact integrity

Audited events

CI runs (public logs)
Release creation
Admin security merges

Secret rotation / revocation

Any leaked secret is revoked, rotated, and documented via advisory
Revoked license immediately downgrades access; no client-side bypass

There aren't any published security advisories