Please do not report security issues through public issues or pull requests.

Use one of these private channels instead:

1. Preferred - open a private security advisory. It is scoped to the maintainer and allows a fix to be prepared privately.
2. Alternative - email roman@lerchster.dev with [murmur security] in the subject.

Please include what the issue is and what it lets an attacker do, how to reproduce it, the Murmur version (gnome-extensions info murmur@roman-16.github.io), and your GNOME Shell version and session type.

You can expect an acknowledgement within 7 days and an assessment within 14. If you hear nothing in a week, follow up, because the message was probably missed.

Only the latest release receives fixes. There is no maintenance branch.

Murmur runs inside the GNOME Shell process, so a flaw here is a flaw in the compositor. Reports about any of the following are welcome:

• Anything that lets another process or a web page read your API key, your audio or your transcription.
• Anything that makes Murmur insert or copy text that did not come from your own dictation, or deliver it to the wrong client.
• Failure to release the microphone, or to stop recording on cancel.
• Certificate or endpoint handling on the connection to Mistral.
• Command injection or unsafe argument handling in the subprocesses Murmur spawns, pw-record and dotool.

• The API key is stored unencrypted in dconf. This is documented in Privacy. GNOME extensions have no access to the system keyring, so every setting, including this one, is readable by anything running as your user. That is the platform, not a defect.
• Audio is sent to Mistral. That is what the extension does. Their handling of it is governed by your agreement with them.
• The transcription is placed on the clipboard when no text field is focused, where a clipboard manager may keep it. This path is announced in the overlay before you speak, and Ctrl+Enter takes it deliberately.
• /dev/uinput access for dotool. Granting it is a deliberate local decision, and its consequences belong to dotool.
• Vulnerabilities in GNOME Shell, mutter, PipeWire, dotool or the Mistral API themselves. Report those upstream; if Murmur can mitigate one, say so here as well.