94 lines
3.4 KiB
Markdown
94 lines
3.4 KiB
Markdown
# Security Policy
|
|
|
|
## 🔒 Security Features
|
|
|
|
Gemini Nexus takes security seriously. Here are the security measures we've implemented:
|
|
|
|
### Encryption
|
|
|
|
- **AES-256-GCM** encryption for all sensitive data (`token_json`, `quota_json`)
|
|
- Unique initialization vectors (IV) for each encryption operation
|
|
- Authenticated encryption to prevent tampering
|
|
|
|
### Credential Storage
|
|
|
|
- **Windows**: Windows Credential Manager
|
|
- **macOS**: macOS Keychain
|
|
- **Linux**: Secret Service API / libsecret
|
|
|
|
Master keys are stored in the OS native credential manager via `keytar`, never in plain text files.
|
|
|
|
### Data Protection
|
|
|
|
- Sensitive tokens are encrypted before storage in SQLite database
|
|
- Automatic migration of legacy plaintext data on application startup
|
|
- No sensitive data is logged or transmitted to external services
|
|
|
|
## 📋 Supported Versions
|
|
|
|
| Version | Supported |
|
|
| -------- | ------------------ |
|
|
| Latest | :white_check_mark: |
|
|
| < Latest | :x: |
|
|
|
|
We only provide security updates for the latest version. Please ensure you're running the most recent release.
|
|
|
|
## 🚨 Reporting a Vulnerability
|
|
|
|
We take all security vulnerabilities seriously. Thank you for helping to improve the security of Gemini Nexus.
|
|
|
|
### How to Report
|
|
|
|
**Please DO NOT report security vulnerabilities through public GitHub issues.**
|
|
|
|
Instead, please report them via one of the following methods:
|
|
|
|
1. **GitHub Security Advisories**: Use our [private vulnerability reporting](https://github.com/Draculabo/AntigravityManager/security/advisories/new)
|
|
2. **Email**: Send details to the project maintainer (see GitHub profile for contact)
|
|
|
|
### What to Include
|
|
|
|
Please include the following information in your report:
|
|
|
|
- Type of vulnerability (e.g., buffer overflow, SQL injection, XSS)
|
|
- Full paths of source file(s) related to the vulnerability
|
|
- Location of the affected source code (tag/branch/commit or direct URL)
|
|
- Step-by-step instructions to reproduce the issue
|
|
- Proof-of-concept or exploit code (if possible)
|
|
- Impact of the issue and how an attacker might exploit it
|
|
|
|
### Response Timeline
|
|
|
|
- **Initial Response**: Within 48 hours
|
|
- **Status Update**: Within 5 business days
|
|
- **Resolution Timeline**: Depends on complexity, typically within 30 days
|
|
|
|
### What to Expect
|
|
|
|
1. **Acknowledgment**: We'll confirm receipt of your report
|
|
2. **Investigation**: We'll investigate and validate the vulnerability
|
|
3. **Fix Development**: We'll develop and test a fix
|
|
4. **Disclosure**: We'll coordinate disclosure timing with you
|
|
5. **Credit**: With your permission, we'll credit you in the release notes
|
|
|
|
## 🛡️ Security Best Practices for Users
|
|
|
|
To ensure the security of your data:
|
|
|
|
1. **Keep Updated**: Always use the latest version of Gemini Nexus
|
|
2. **System Security**: Keep your operating system updated
|
|
3. **Secure Environment**: Use the application on trusted devices only
|
|
4. **Backup**: Regularly backup your account data using the built-in backup feature
|
|
5. **Review Permissions**: Only grant necessary OAuth permissions
|
|
|
|
## 📜 Disclosure Policy
|
|
|
|
When we receive a security bug report, we will:
|
|
|
|
1. Confirm the problem and determine affected versions
|
|
2. Audit code to find any similar problems
|
|
3. Prepare fixes for all supported versions
|
|
4. Release new versions as soon as possible
|
|
|
|
Thank you for helping keep Gemini Nexus and its users safe!
|