From c735f9b0d55b8b086d78e3b76a4c26dc49bd93d2 Mon Sep 17 00:00:00 2001 From: Loopii Date: Sun, 8 Nov 2026 18:18:50 +0200 Subject: [PATCH] docs: replace template SECURITY.md with product-specific policy Was the 500-byte generic template. Now documents ScreenNote's actual handling: local drafts, scoped publishing, bearer viewing links, recording hygiene, and reporting process. --- SECURITY.md | 60 +++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 54 insertions(+), 6 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index ee58392..a536b63 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,10 +1,58 @@ # Security Policy -We take security seriously. If you discover a vulnerability in any of our repositories, please follow these steps: +## Reporting a vulnerability -1. **Do not** publicly disclose the issue. -2. Send a detailed report to **security@buttercode101.com** (or open a private issue if you prefer). -3. Include steps to reproduce, the impact, and any suggested fixes. -4. We will acknowledge receipt within 48 hours and aim to resolve the issue promptly. +If you discover a security issue in ScreenNote, please report it +**privately** rather than opening a public issue: -Our goal is to keep all projects safe for users and contributors. +- Email: **security@buttercode101.com**, or +- Open a GitHub private vulnerability report on this repository. + +Include steps to reproduce, the impact you believe it has, and any +suggested fix. We acknowledge reports within 48 hours and aim to +resolve confirmed issues promptly. Please do not disclose the issue +publicly until a fix is available. + +## What ScreenNote stores, and where + +ScreenNote records, shares, and discusses short screen videos with +timestamped feedback. + +- **Capture stays on your device until you publish.** Drafts are + local; nothing is shared until you choose to publish a viewing link. +- **Published videos and comments are stored in object storage + (Vercel Blob / Supabase) and served via the app's publishing API.** + A published link should be treated as sharing the video with anyone + who holds it. Unpublish or delete recordings you no longer want + public. +- **Client publishing uses server-issued, scoped storage access.** + Uploads pass server-side validation (file type, size, record paths); + storage-gateway errors are handled without leaking database + internals to clients. + +## Data handling best practice + +- Record only screens you are entitled to share; screen recordings + often capture credentials, personal messages, and unrelated + windows. +- Do not publish links publicly if the video contains sensitive + material, even temporarily. +- Report suspected unauthorized access or storage exposure + immediately via the channel above. + +## Known limitations (not vulnerabilities) + +- No automatic transcription or AI analysis is performed; comments + are human feedback, not moderation. +- Viewing links are bearer capability links: there is no account + system, so link confidentiality is the access control. +- Deleted or unpublished items may persist in platform backups for a + limited time per the storage provider's policy. + +## Scope + +In scope: the web app and publishing API, the Android client, and +the verification workflows in this repository. + +Out of scope: third-party storage and hosting platforms (Vercel Blob, +Supabase, GitHub) except as integrated through this app's server.