nvrl
6e9beb4b16
ARCHITECTURE.md described the 2.x write path, where namespace changes waited for Drive and every mount had its own inode space. Rewrite it around the local tree (lid, inode = lid + 1, local~<lid> stand-ins), the queue and its 16 drain workers, sync issues, and the remaining split between the mount and the mirror engine. Drop the pins.json claim; pins moved into the database at schema v5. TESTING.md gains the simulation runs and loses the per-case narrative that --list and BUGS.md already carry. ROADMAP.md takes over the post-3.0.0 items from the milestone status file. Remove MILESTONE-3.0.0-STATUS.md (a working log) and UI_UX_PLAN.md (the 2.x design audit). Code comments and CI that cited the untracked docs/MILESTONE-3.0.0.md now point at TESTING.md, ARCHITECTURE.md and ROADMAP.md. Threat-model links follow the section to §10.
2.0 KiB
Security Policy
Supported versions
Fixes land on the latest release. Please reproduce on the most recent version before reporting.
Reporting a vulnerability
Do not open a public issue. Report privately through GitHub's private vulnerability reporting, or by email to contact@narl.io.
Please include the version (pdfs --version), your distribution and desktop environment, what an
attacker gains, and a reproduction if you have one. You can expect an acknowledgement within a few
days; a fix ships in the next release, and you are credited in the advisory unless you ask
otherwise.
Scope
This client holds Proton account credentials and decrypted file content on the local machine, so the interesting boundaries are:
- Credentials. Sessions and the mailbox password live in the system Secret Service. Anything that writes them elsewhere — logs, temp files, crash dumps — is a vulnerability.
- The control socket. Anything that can connect to
control.sockhas the daemon's authenticated session. It is0600, and the state, cache, and config directories must be real, current-user-owned0700directories; the daemon fails closed otherwise. Reports that defeat those checks are in scope. - Local cache and staging. Decrypted block content and staged writes on disk.
- Cryptography. Key derivation, signature handling, and anything that could publish plaintext or the wrong key material to Proton.
What the client deliberately keeps in plaintext on disk, and why, is documented in the threat model. Behaviour described there is known and not a vulnerability by itself; a way to make it worse than described is.
Out of scope: vulnerabilities in Proton's own service (report those to Proton AG), and issues that require an attacker who already has your user account on the machine.