This repository is actively maintained around the new_arch HarmonyOS frontend path.

Security-sensitive areas include:

• NAPI boundary code under entry/src/main/cpp/app/napi/
• Native rendering and buffer access
• File import / sandbox path handling
• Dynamic core loading

Please do not open a public issue for suspected security problems.

Report with:

• affected file or area
• reproduction steps
• impact summary
• logs or screenshots if safe to share

Current private contact path:

• Use the AppGallery Connect developer contact entry for the published app.
• For repository triage, follow SUPPORT.md. Do not post exploit details, signing material, secrets, or user data in public issues.

• Path traversal or unsafe file access
• Loading untrusted native core binaries from writable locations without validation
• Native buffer misuse
• Cross-thread unsafe NAPI usage
• Secret or signing material leakage

• Triage first, patch second.
• Fix the root cause, not only the symptom.
• Add or update a guard script when the issue can regress silently.