colour-tools/SECURITY.md

Security policy

Supported versions

Security fixes are made on the current release line. Users should update to the latest published tag and verify the release ZIP against its .sha256 sidecar.

Reporting a vulnerability

Please report a suspected vulnerability privately to the repository owner via the contact channel shown on the Gitea profile or a private Gitea message. Do not include private images, access tokens, unpublished exploit details or other sensitive material in a public issue.

Include the affected version, browser and operating system; a minimal local reproduction; the expected impact; and whether the issue requires a crafted image, palette or colour string. You should receive acknowledgement within seven days. Coordinated disclosure is appreciated while a fix and release are prepared.

Security model

Colour Tools is a static browser application. It has no application backend, account system, analytics endpoint or image-upload endpoint. All selected image bytes are decoded and processed locally. Saved palette entries use browser storage for the current origin. Clipboard, file picker, download and EyeDropper actions happen only after a user gesture and remain governed by browser permissions.

File processing is deliberately bounded by encoded byte size, decoded pixel count and dimensions. Image palette extraction samples a bounded number of pixels and can run in a disposable worker. Object URLs and worker jobs are cancelled or released when replaced. Input is displayed as text or parsed by typed colour/image APIs; it is not evaluated as script or inserted as trusted HTML.

Production hosts should serve the headers in docs/PRIVACY-SECURITY.md, use HTTPS, keep MIME types correct, disable content sniffing and avoid injecting third-party scripts. A host can still observe ordinary HTTP metadata for the initial static-file request; “local-first” describes application data processing, not anonymity from the static host.

Out of scope

Colour rendering differences between conforming browser/OS colour-management pipelines are not vulnerabilities by themselves. Likewise, an approximate colour-vision simulation is an educational preview, not a medical diagnosis or a complete accessibility guarantee.