023714442d
- CHANGELOG.md: Phase 1~13 + 랜딩 페이지 전체 변경 이력 - LICENSE: MIT - CONTRIBUTING.md: 개발 환경, 코드 표준, PR 프로세스 - SECURITY.md: 보안 정책, 취약점 보고 절차 - .editorconfig: 에디터 설정 통일 (indent, charset, eol) - .nvmrc: Node.js 20 - .gitattributes: line ending 정규화, 바이너리 선언, linguist 설정 - .gitignore: site/dist, Python, Whisper 모델 등 누락 항목 추가
34 lines
1 KiB
Markdown
34 lines
1 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| 1.0.x | :white_check_mark: |
|
|
|
|
## Privacy by Design
|
|
|
|
D3RO Voice processes all data locally. No audio, text, or telemetry is transmitted to external servers. The application is designed to work completely offline after initial model download.
|
|
|
|
- **Audio**: Captured and processed in-memory, optionally saved to local SQLite
|
|
- **STT**: faster-whisper runs as a local sidecar process
|
|
- **LLM**: Ollama runs on localhost:11434
|
|
- **License**: One-time online activation, 30-day offline grace period
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability, please report it responsibly:
|
|
|
|
1. **DO NOT** open a public issue
|
|
2. Email: security@d3ro.dev
|
|
3. Include steps to reproduce and potential impact
|
|
4. We will respond within 48 hours
|
|
|
|
## Scope
|
|
|
|
Security concerns include:
|
|
- Local data exposure or leakage
|
|
- IPC channel injection or privilege escalation
|
|
- Unintended network traffic
|
|
- Clipboard data exposure
|
|
- Sidecar process escape
|