Initial release

SECURITY.md

@@ -0,0 +1,25 @@
+# Security
+
+Knotchy exists to keep untrusted pages away from your Mac, so a security bug here is the worst kind of bug. If you
+find one, thank you.
+
+## Reporting a vulnerability
+
+Please report it privately: on this repository's **Security** tab, choose **Report a vulnerability**. Don't open a
+public issue for it.
+
+Tell us what you found, how to reproduce it, and which versions of Knotchy and macOS you used. We'll reply within a
+few days, and we'll have a fix or a plan before anything is made public.
+
+## What counts
+
+- A page in the VM reaching your Mac, your local network, or anything else the firewall should block
+- Getting around a proxy or VPN route's kill switch
+- Knotchy running code on the Mac, or installing anything other than Apple's pinned `container` package
+- Proxy passwords or VPN keys leaking from the keychain or from the VM's secrets share
+
+A page taking over the browser inside the VM is expected; that's what the VM is for. Escaping the VM is what counts.
+
+## Supported versions
+
+Only the latest release gets fixes.