Report privately
Do not publish vulnerability detailsUse a private GitHub Security Advisory. Never include credentials, user data, private links, or exploit instructions in a public issue.
- Open the repository's private vulnerability report.
- Include the version or URL, platform, reproduction steps, impact, and suggested remediation.
- If private reporting is unavailable, open a public issue with no technical details and request a private contact channel.
Maintainers aim to acknowledge a report within seven days, provide an initial assessment within fourteen days, and coordinate disclosure after a fix. These are targets rather than guarantees.
Built-in safeguards
- Narrow Tauri capabilities and a restrictive Content Security Policy.
- Remote origins limited to documented GitHub Pages, weather, analytics, and media services.
- Consent-gated analytics with advertising storage and personalization disabled.
- CodeQL, dependency review, npm and Rust audits, linting, tests, and cross-platform native builds.
- Dependabot monitoring for npm, Cargo, and GitHub Actions.
- SHA-256 release checksums and GitHub build-provenance attestations.
Research guidelines
Good-faith testing must avoid privacy violations, data destruction, denial of service, social engineering, physical attacks, or testing third-party infrastructure without permission. Findings in GitHub, Google, Open-Meteo, Coverr, browsers, or operating-system WebViews should also be sent to the affected provider.
Verify downloads
Install only from official GitHub Releases and follow the checksum and provenance instructions. Provenance confirms where an artifact was built; it is not a guarantee that the software contains no vulnerability.