Skip to content

SECURITY.md

Latest commit

 

History

History
43 lines (28 loc) · 1.5 KB

SECURITY.md

File metadata and controls

43 lines (28 loc) · 1.5 KB
Raw

Security Policy

Supported Versions

The current public source release is 2.x.

Reporting A Vulnerability

Please report security issues privately before opening a public issue. If the repository does not yet have GitHub private vulnerability reporting enabled, contact the maintainer directly and include:

  • A short description of the issue.
  • Steps to reproduce.
  • Impact and affected platform.
  • Any suggested fix, if known.

Current Security Model

PromptVault is a local-first Electron app. It is designed to load its own bundled renderer and operate on folders explicitly selected by the user.

Important constraints:

  • The renderer must not load arbitrary remote websites.
  • File-system access is intentionally exposed through the preload bridge for local prompt library management.
  • The current app uses local media paths for image and video preview behavior.
  • The current Content Security Policy allows development conveniences used by the Vite/Electron setup.

Before using PromptVault as a network-connected or remote-content app, harden the Electron configuration:

  • Remove webSecurity: false.
  • Replace direct file:// media loading with a stricter custom protocol.
  • Validate that all file operations stay inside the selected library root.
  • Narrow the Content Security Policy for production.
  • Add automated tests for destructive file operations.

Dependency Updates

Run the dependency audit before releases:

npm audit

Patch high and critical findings before publishing binaries.