Reporting a vulnerability

Privately, never as a public issue.

• Open a security advisory on GitHub — visible only to you and the maintainer — or
• email info@stackvo.io.

Include what you did, what happened, and which version and platform. A proof of concept helps but is not required to file.

What you can expect

Acknowledgement	within 72 hours
Assessment	within a week
Disclosure	on a date agreed with you, after the fix if one is needed

Only the latest release is supported. This is a pre-1.0 project, and there is no backport branch.

What is in scope

StackVo is a local development tool, so it can reach more than a typical desktop app: the Docker socket, the hosts file, project directories, subprocesses, .env files, and service packages written by other people. Each has a boundary, and the security policy lists them in a table. A report that crosses one is in scope:

• escaping the workspace — reading or writing outside <workspace>/projects/;
• reaching Docker, the hosts file or a subprocess with input the user did not supply, for example through a crafted stackvo.json or .env;
• a secret leaving the process — in an event payload, in the diagnostic log, in a rendered view;
• defeating update signature verification;
• a build that contacts a host PRIVACY.md does not name.

What is not

• Anything that needs an attacker who already has your user account. The app runs as you and manages your own machine; it is not a privilege boundary against yourself.
• Docker being able to do Docker things. Access to the socket is the point.
• Advisories on unmaintained transitive crates in Tauri's Linux stack. They are tracked in src-tauri/deny.toml with the reasoning; a real vulnerability in one of them is in scope.