This project is a reference implementation. Only the latest version on main receives security fixes.

Please do not open a public GitHub issue for security vulnerabilities.

Report security issues by emailing security@cephable.com. Include:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a proof-of-concept
• Any suggested fix (optional but appreciated)

We will acknowledge your report within 2 business days and aim to release a fix within 14 days for confirmed issues.

This repository is a local desktop app. Relevant areas for security research include:

• Electron context isolation / IPC — the preload bridge (src/preload/) should never expose unsafe Node.js APIs to the renderer
• OAuth / deep-link handling — the selllocal://auth/callback custom protocol should only pass tokens from the expected origin
• SQLite access — all database operations run in the main process via IPC; the renderer should not have direct DB access
• Credential handling — VITE_CEPHABLE_CLIENT_SECRET is baked into the renderer bundle at build time; this project is designed for local use only and should not be deployed as a public server

• Vulnerabilities in node_modules dependencies (report those to the upstream package)
• Issues that require physical access to the machine
• Theoretical issues with no practical exploit path