f93417dc3c
Enforce an optional TLP release ceiling at the single export chokepoint so no format (PDF/PPTX/HTML) can bypass it. Classifying a deck stays optional; the gate only blocks decks classified above the configured ceiling, and is off by default. - ClassificationPolicy + ExportDecision: pure, tested decision logic (release ceiling, fail-closed; null = no gate). - ExportService.export() evaluates the policy first and refuses without building or writing anything when blocked. - Persist the ceiling as maxReleaseExportTlpKey in app settings/prefs (default off) with a setter on SettingsNotifier. - Export dialog runs the same check up front and explains a blocked export before any work starts; app shell builds the policy from settings. - Tests: classification_policy_test plus export_service chokepoint tests asserting a blocked export fails and writes no file. - Docs: CHANGELOG, README, USER_GUIDE, ARCHITECTURE, SECURITY. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
47 lines
1.8 KiB
Markdown
47 lines
1.8 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Please do not report security vulnerabilities through public GitHub issues,
|
|
discussions, or pull requests.**
|
|
|
|
Instead, report them privately via GitHub's **"Report a vulnerability"** button
|
|
under the repository's **Security** tab (Security Advisories). If that is not
|
|
available to you, contact the maintainer directly and wait for a reply before
|
|
disclosing anything publicly.
|
|
|
|
When reporting, please include as much of the following as you can:
|
|
|
|
- A description of the issue and its impact.
|
|
- Steps to reproduce (a minimal deck or input file if relevant).
|
|
- The OciDeck version, operating system, and Flutter version.
|
|
- Any proof-of-concept, logs, or screenshots.
|
|
|
|
## What to expect
|
|
|
|
- **Acknowledgement** of your report as quickly as we reasonably can.
|
|
- An assessment and, where confirmed, a fix developed under coordinated
|
|
(responsible) disclosure.
|
|
- Credit for the discovery if you wish — let us know how you would like to be
|
|
named.
|
|
|
|
We ask that you give us a reasonable opportunity to address the issue before any
|
|
public disclosure, and that you avoid privacy violations, data destruction, or
|
|
service disruption while researching.
|
|
|
|
## Scope notes
|
|
|
|
OciDeck is an offline desktop application. Areas of particular interest:
|
|
|
|
- Parsing of untrusted decks (`.md`), packages (`.ocideck`), sidecars
|
|
(`.ink.json`, captions), and linked CSV data.
|
|
- Importing presentations from a URL.
|
|
- The HTML export, which inlines third-party JavaScript (marked, highlight.js,
|
|
mermaid, MathJax) to render offline.
|
|
- The export classification gate (`ClassificationPolicy`) — any way to export a
|
|
deck classified above the configured release ceiling.
|
|
|
|
## Supported versions
|
|
|
|
Security fixes target the latest released version and the default development
|
|
branch. Older versions may not receive fixes.
|