Release Privacy Tools 0.1.0

public/SECURITY.md

@@ -0,0 +1,33 @@
+# Security
+
+Report vulnerabilities privately to the repository owner. Do not attach a
+sensitive source image, generated report, or real metadata to a public issue;
+construct a minimal synthetic reproduction instead.
+
+## Input model
+
+Every selected file and every metadata value is untrusted. The application
+detects containers from bytes, does not execute imported content, renders text
+through React rather than raw HTML, performs no metadata-linked fetches, and
+does not preserve source blocks in a re-encoded output. The scanning worker can
+be terminated on cancellation. Browser-native pixel decoding remains part of
+the browser's trusted computing base.
+
+Default bounds cover file/batch bytes, container blocks, individual metadata,
+decompressed PNG metadata, finding lengths/counts, TIFF offsets/entries/depth,
+pixel count/edge, and batch ZIP size. Malformed structures become partial or
+failed coverage; they must never receive clean-copy eligibility or a verified
+output result.
+
+## Output model
+
+A successful Canvas encode is not sufficient. The new bytes are independently
+hashed and scanned, expected oriented dimensions are checked, sensitive or
+provenance findings fail the verification gate, and incomplete coverage is
+reported. C2PA/JUMBF signatures are expected to be removed or invalidated by
+pixel re-encoding. Reports and output names are escaped/sanitized and ZIP paths
+are application-generated.
+
+No status is an anonymity guarantee. Visible content, steganography, invisible
+watermarks, image fingerprinting, sidecars, local filesystem metadata, browser
+history, and remote copies are outside the scan.