Only the latest released version receives security updates.

If you believe you have found a security issue in DiskIdentifier, please report it privately to the maintainers rather than opening a public issue.

DiskIdentifier is a local disk registration service that involves:

• HTTP API endpoints under /api/* for registering, locating, and forgetting disk identifiers
• Disk root access — enumerating and reading disk volumes to register and resolve persistent identifiers
• Hidden file writes — writing <UNIVERSAL_DISK_IDENTIFIER_ID>.id files on registered disk volumes
• Identifier persistence — storing registered disk identifiers and the universal identifier in the .env file
• In-memory cache — maintaining disk-to-identifier associations refreshed every 30 seconds

Include as much detail as possible, such as:

• A clear description of the issue and the affected endpoint or component
• Steps to reproduce the problem
• Whether the issue involves disk-root file writes, .env manipulation, or identifier forgery
• Any relevant logs or proof of concept code
• The potential impact and how severe you believe it is

If the report involves secrets or identifiers, redact sensitive values before sharing.

After a report is received:

1. The issue will be reviewed and triaged.
2. You may be contacted for clarification or additional details.
3. A fix may be developed and validated before public disclosure.
4. The reporter may be credited unless they prefer to remain anonymous.

This project is intended to follow basic security hygiene:

• Localhost binding — The service binds to 127.0.0.1:49157 by default. Do not change the bind address to 0.0.0.0 or any non-loopback interface. All API endpoints enforce local-device-only access.
• Hidden file writes — DiskIdentifier writes hidden .id files on registered disk volumes. Treat these files as service-internal artifacts and do not modify or delete them outside of the API.
• Environment file storage — Registered disk identifiers and the universal identifier are persisted in .env in the project root. Keep this file protected and exclude it from version control.
• Identifiers are not keys — SHA-256 identifiers generated by DiskIdentifier are plain disk-root associations, not cryptographic secrets or authorization tokens.
• Dependency review — Flask is the only runtime web dependency. Pin versions in requirements.txt and review new dependencies before adding them.
• Configuration file — Settings in resources/configuration.json control the port and integration options. Validate its contents at installation time.
• Treat all externally supplied input as untrusted and validate it before use. The API validates path formats, identifier formats, and input types across all endpoints.

Do not publicly disclose an unpatched vulnerability until maintainers have had reasonable time to investigate and respond. If a coordinated disclosure timeline is needed, it can be discussed during the report process.