Skip to content

SECURITY.md

Latest commit

 

History

History
40 lines (29 loc) · 1.2 KB

SECURITY.md

File metadata and controls

40 lines (29 loc) · 1.2 KB
Raw

Security Policy

Reporting Vulnerabilities

Please report security vulnerabilities by opening a GitHub issue at github.com/XPDevs/OFL/issues or by contacting XPDevs directly.

Supported Versions

Version Supported
0.1.x Yes

Security Model

  • Local-first: No remote network access by default
  • Daemon: Binds to local Unix domain socket only
  • No telemetry: Zero network calls except local IPC
  • Filesystem safety: Respects OS permissions
  • Symlinks: Not followed by default
  • Hidden files: Excluded by default
  • Path traversal: Prevented via root validation
  • Query limits: Complexity limits enforced to prevent resource exhaustion

Threat Model

OFL is designed for local use. It trusts the local user but protects against:

  • Malicious file names
  • Path traversal attacks
  • Resource exhaustion via complex queries
  • Index corruption (detected via SHA-256 checksums)
  • Symlink loops

Best Practices

  • Run with minimal filesystem permissions
  • Use follow_symlinks: false (default)
  • Use include_hidden: false (default)
  • Set appropriate max_depth limits
  • Monitor daemon resource usage in production