0 Fork 0

mirror of https://github.com/Ryder-Sun/Meldwork.git synced 2026-11-07 06:56:03 -10:00

Files

T

Ryder Sun d8c701b296 chore(release): prepare the public MVP

Adopt AGPL-3.0-only for the Community Edition, reserve separate commercial licensing, and set the permanent macOS Bundle ID to com.rydersun.meldwork. Add fail-closed Developer ID/notarization preflight and post-sign checks, package license notices, and refresh public MVP, signing, architecture, security, and verification documentation.

Checks: frontend 237/237; desktop 842/842; web and desktop builds; production audits; pack and DMG/ZIP dist; strict codesign; clean-profile packaged startup; archive Bundle ID/license inspection; Markdown links; git diff --check.

2026-08-06 10:51:06 +08:00

1.5 KiB

Raw Blame History

Security Policy

Meldwork is a local-first desktop application that invokes local Agent CLIs, stores local conversations, imports validated image, media, document, code, and archive attachments, and manages Provider credentials through the Electron main process.

Reporting

Please report security issues privately through GitHub Security Advisories for this repository, or contact the repository owner through GitHub if advisories are unavailable.

Do not open a public issue with exploit details, secrets, local file paths, or private workspace data.

In Scope

Renderer-to-main IPC authorization bypasses.
Exposure of executable paths, attachment paths, native session references, Provider API keys, or Skill file paths to renderer code.
Arbitrary shell execution, arbitrary file read/write, unsafe navigation, or unsafe installer behavior.
Attachment validation, private storage, checksum, or preview isolation failures.
Credential storage or Provider configuration failures that expose secrets.

Out of Scope

Vulnerabilities in upstream Agent CLIs, model Providers, or third-party package registries.
Issues that require changing the local operating-system user's account permissions.
Reports based only on missing enterprise features such as SSO, centralized audit logs, device management, or notarized public release distribution.

Supported Version

The current repository state is a market-validation MVP. Security fixes target the default branch unless a release branch is explicitly created.