nvrl
af869944cf
Split the README into a short front page and task-oriented pages under docs/: installation, user guide, CLI reference, configuration and troubleshooting, with an index in docs/README.md. Rewrite RECOVERY.md around Continue This Backup Here and Restore Folders, and DEVELOPMENT.md around running, debugging and releasing from source. Bring ARCHITECTURE.md up to date with the read path, push events, the thread map, conflict copies and the machine profile, and move the feature design notes there. Collect planned work in ROADMAP.md. Link the threat model from SECURITY.md and the translation rules from CONTRIBUTING.md. Add scripts/publish-wiki.sh, which mirrors the user pages to the GitHub wiki with rewritten links and only pushes with --push.
1.9 KiB
Security Policy
Supported versions
Fixes land on the latest release. Please reproduce on the most recent version before reporting.
Reporting a vulnerability
Do not open a public issue. Report privately through GitHub's private vulnerability reporting, or by email to contact@narl.io.
Please include the version (pdfs --version), your distribution and desktop environment, what an
attacker gains, and a reproduction if you have one. You can expect an acknowledgement within a few
days; a fix ships in the next release, and you are credited in the advisory unless you ask
otherwise.
Scope
This client holds Proton account credentials and decrypted file content on the local machine, so the interesting boundaries are:
- Credentials. Sessions and the mailbox password live in the system Secret Service. Anything that writes them elsewhere — logs, temp files, crash dumps — is a vulnerability.
- The control socket. Anything that can connect to
control.sockhas the daemon's authenticated session. It is0600, and the state, cache, and config directories must be real, current-user-owned0700directories; the daemon fails closed otherwise. Reports that defeat those checks are in scope. - Local cache and staging. Decrypted block content and staged writes on disk.
- Cryptography. Key derivation, signature handling, and anything that could publish plaintext or the wrong key material to Proton.
What the client deliberately keeps in plaintext on disk, and why, is documented in the threat model. Behaviour described there is known and not a vulnerability by itself; a way to make it worse than described is.
Out of scope: vulnerabilities in Proton's own service (report those to Proton AG), and issues that require an attacker who already has your user account on the machine.