51 lines
2.3 KiB
Markdown
51 lines
2.3 KiB
Markdown
# Security policy
|
|
|
|
## Supported versions
|
|
|
|
Security fixes are made on the current release line. Users should update to the
|
|
latest published tag and verify the release ZIP against its `.sha256` sidecar.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please report a suspected vulnerability privately to the repository owner via
|
|
the contact channel shown on the
|
|
[Gitea profile](https://git.add-ideas.de/lotobo) or a private Gitea message. Do
|
|
not include private images, access tokens, unpublished exploit details or other
|
|
sensitive material in a public issue.
|
|
|
|
Include the affected version, browser and operating system; a minimal local
|
|
reproduction; the expected impact; and whether the issue requires a crafted
|
|
image, palette or colour string. You should receive acknowledgement within
|
|
seven days. Coordinated disclosure is appreciated while a fix and release are
|
|
prepared.
|
|
|
|
## Security model
|
|
|
|
Colour Tools is a static browser application. It has no application backend,
|
|
account system, analytics endpoint or image-upload endpoint. All selected image
|
|
bytes are decoded and processed locally. Saved palette entries use browser
|
|
storage for the current origin. Clipboard, file picker, download and EyeDropper
|
|
actions happen only after a user gesture and remain governed by browser
|
|
permissions.
|
|
|
|
File processing is deliberately bounded by encoded byte size, decoded pixel
|
|
count and dimensions. Image palette extraction samples a bounded number of
|
|
pixels and can run in a disposable worker. Object URLs and worker jobs are
|
|
cancelled or released when replaced. Input is displayed as text or parsed by
|
|
typed colour/image APIs; it is not evaluated as script or inserted as trusted
|
|
HTML.
|
|
|
|
Production hosts should serve the headers in
|
|
[docs/PRIVACY-SECURITY.md](docs/PRIVACY-SECURITY.md), use HTTPS, keep MIME types
|
|
correct, disable content sniffing and avoid injecting third-party scripts. A
|
|
host can still observe ordinary HTTP metadata for the initial static-file
|
|
request; “local-first” describes application data processing, not anonymity
|
|
from the static host.
|
|
|
|
## Out of scope
|
|
|
|
Colour rendering differences between conforming browser/OS colour-management
|
|
pipelines are not vulnerabilities by themselves. Likewise, an approximate
|
|
colour-vision simulation is an educational preview, not a medical diagnosis or
|
|
a complete accessibility guarantee.
|