mirror of
https://github.com/aculix/knotchy.git
synced 2026-10-27 07:15:53 +00:00
26 lines
1.0 KiB
Markdown
26 lines
1.0 KiB
Markdown
# Security
|
|
|
|
Knotchy exists to keep untrusted pages away from your Mac, so a security bug here is the worst kind of bug. If you
|
|
find one, thank you.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please report it privately: on this repository's **Security** tab, choose **Report a vulnerability**. Don't open a
|
|
public issue for it.
|
|
|
|
Tell us what you found, how to reproduce it, and which versions of Knotchy and macOS you used. We'll reply within a
|
|
few days, and we'll have a fix or a plan before anything is made public.
|
|
|
|
## What counts
|
|
|
|
- A page in the VM reaching your Mac, your local network, or anything else the firewall should block
|
|
- Getting around a proxy or VPN route's kill switch
|
|
- Knotchy running code on the Mac, or installing anything other than Apple's pinned `container` package
|
|
- Proxy passwords or VPN keys leaking from the keychain or from the VM's secrets share
|
|
|
|
A page taking over the browser inside the VM is expected; that's what the VM is for. Escaping the VM is what counts.
|
|
|
|
## Supported versions
|
|
|
|
Only the latest release gets fixes.
|