diff options
| author | cirakg <cirakg@cirakg.xyz> | 2026-10-28 11:45:11 +0100 |
|---|---|---|
| committer | cirakg <cirakg@cirakg.xyz> | 2026-10-28 11:45:11 +0100 |
| commit | 09ef21af399a60ceb2e45526fe1a7dd94c53819c (patch) | |
| tree | 7992abb501f75dfe393b2bfd424227d1fc06b5b6 /SECURITY.md | |
| parent | 3096eb7d366683caec24ed5d0a70ac5dae6f624d (diff) | |
chore: prepare repository for open-source release
Diffstat (limited to 'SECURITY.md')
| -rw-r--r-- | SECURITY.md | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..9a7458a --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,15 @@ +<!-- + Author: cirakg & claude ai + Summary: Vulnerability reporting and the limits of the app's security model. +--> +# Security policy + +Security fixes target the current release. The storage design, threat model and known limitations are documented in [docs/SECURITY.md](docs/SECURITY.md). + +## Reporting a vulnerability + +Send a private report to the maintainer at <cirakg@cirakg.xyz>. Include the affected version, watch model, impact, reproduction steps and a minimal example using fabricated data. Do not send real OTP seeds, PINs, authenticator exports, developer keys or watch storage dumps. Avoid posting exploit details publicly before a fix or coordinated disclosure. There is no guaranteed response time. + +## Known limits + +The four-digit PIN has only 10,000 possibilities. Lockout slows guesses on the watch, but cannot protect a copied storage dump from offline guessing. Unlocked entries use a device key stored alongside the app data. Secrets pasted into Garmin Connect settings pass through Garmin's infrastructure. Keep a secure backup in your primary authenticator; the app has no export or backup feature. Test keys in this repository are public demonstration data. |