From 09ef21af399a60ceb2e45526fe1a7dd94c53819c Mon Sep 17 00:00:00 2001 From: cirakg Date: Wed, 28 Oct 2026 11:45:11 +0100 Subject: chore: prepare repository for open-source release --- SECURITY.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 SECURITY.md (limited to 'SECURITY.md') diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..9a7458a --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,15 @@ + +# Security policy + +Security fixes target the current release. The storage design, threat model and known limitations are documented in [docs/SECURITY.md](docs/SECURITY.md). + +## Reporting a vulnerability + +Send a private report to the maintainer at . Include the affected version, watch model, impact, reproduction steps and a minimal example using fabricated data. Do not send real OTP seeds, PINs, authenticator exports, developer keys or watch storage dumps. Avoid posting exploit details publicly before a fix or coordinated disclosure. There is no guaranteed response time. + +## Known limits + +The four-digit PIN has only 10,000 possibilities. Lockout slows guesses on the watch, but cannot protect a copied storage dump from offline guessing. Unlocked entries use a device key stored alongside the app data. Secrets pasted into Garmin Connect settings pass through Garmin's infrastructure. Keep a secure backup in your primary authenticator; the app has no export or backup feature. Test keys in this repository are public demonstration data. -- cgit v1.2.3