Missing security and quality.md

[george1612]

Isn't such a file a must to prevent potential security findings being reported as regular issues?

[DevEmperor]

You were right, and it turned out the file was the smaller half of it. Done now — three things, because on their own none of them would have solved what you actually pointed at.

Private vulnerability reporting is enabled. That was off, which meant there was no private channel at all: someone who found something had a choice between a public issue and my inbox. There is now a Report a vulnerability button on the Security tab, and reports become published advisories with credit once fixed.

The issue chooser leads with it. This is the part that actually prevents what you described. Nobody reads SECURITY.md before clicking "New issue" — and this repo had no issue templates at all, so "New issue" went straight to an empty box with nothing in between. There is now a chooser with a security link at the top. Blank issues stay enabled, since there is no bug-report form here and taking the plain box away would leave people with nowhere to file an ordinary bug.

SECURITY.md is the destination. It is written for this app rather than copied from a template, because the interesting part is the scope: a keyboard sees everything typed, holds your provider keys, and can drive an accessibility service in other apps. Those are named explicitly, along with the Cloud wallet and the extension loader — the two places where someone else's money or a crafted file could do real damage.

It also has a "not vulnerabilities" section, which I think matters as much as the rest. Several of this app's properties look alarming and are deliberate: audio goes to the provider you configured, the API key sits in app-private storage, plain HTTP reaches a LAN server you typed in yourself, and "trust user certificates" is an off-by-default switch for people running their own CA. Better to state those once than to answer them one report at a time.

No response deadline is promised. I am one person; committing to 48 hours would break the first time I take a week off, and a broken promise is worse than none. What it says instead is: acknowledgement within a few days, you will be told what I found, and if I go quiet you should ping the thread.

On the quality half of your title — I have deliberately not added a QUALITY.md. It is not a convention and nothing consumes it; the conventional home for quality and contribution expectations is CONTRIBUTING.md, which the README already promises. That is a separate decision from the security channel and I would rather do it properly than bundle it in here. If you had something specific in mind under that heading, say so and I will pick it up as its own thread.

Thanks for raising it — it had been sitting in the blind spot where you only notice it the day it matters.