Skip to content

Security

Reporting a vulnerability

Please report vulnerabilities privately through GitHub Security Advisories (“Report a vulnerability” on the repository’s Security tab). Do not open a public issue.

You will get an acknowledgment within 7 days and a fix or a plan within 30.

Scope

  • The Alcuin application: query execution, catalog access, edits.
  • Secret handling: connection passwords and SSH passphrases must never reach the renderer, the local state database, logs, crash reports or copied URLs.
  • The auto-updater and the signed release artifacts.
  • Electron hardening: context isolation, sandbox, CSP, custom protocol, fuses.

Out of scope: vulnerabilities in the Postgres server you connect to.

Supported versions

Only the latest release receives fixes.

How the app is hardened

Section titled “How the app is hardened”

Alcuin’s window shows a web page, so the desktop app keeps that page boxed in:

  • Every window’s page runs in Chromium’s sandbox, with context isolation on and no access to Node.
  • A page loads only Alcuin’s own content. It can’t navigate anywhere else or open a window of its own. A link to an https:// address opens in your browser instead.
  • A content security policy lets a page run only the app’s own scripts. It can’t be framed, post a form or load a plugin.
  • A page is refused every permission, such as the camera, microphone or location, except writing text to the clipboard. Reading the clipboard is never allowed.
  • The packaged app can’t be run as a plain Node runtime, and it ignores NODE_OPTIONS and Node’s debugging flags. It loads its code only from its own app archive, and on macOS checks that archive’s integrity before it runs.
  • A release refuses to package an Electron version older than the first one with no known high-severity advisory.

Privacy lists what the app sends and keeps, and Verify a download shows how to check an installer.