blob: 9a7458a868300921a2ef9c376237dfddc02257b9 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
<!--
Author: cirakg & claude ai
Summary: Vulnerability reporting and the limits of the app's security model.
-->
# Security policy
Security fixes target the current release. The storage design, threat model and known limitations are documented in [docs/SECURITY.md](docs/SECURITY.md).
## Reporting a vulnerability
Send a private report to the maintainer at <cirakg@cirakg.xyz>. Include the affected version, watch model, impact, reproduction steps and a minimal example using fabricated data. Do not send real OTP seeds, PINs, authenticator exports, developer keys or watch storage dumps. Avoid posting exploit details publicly before a fix or coordinated disclosure. There is no guaranteed response time.
## Known limits
The four-digit PIN has only 10,000 possibilities. Lockout slows guesses on the watch, but cannot protect a copied storage dump from offline guessing. Unlocked entries use a device key stored alongside the app data. Secrets pasted into Garmin Connect settings pass through Garmin's infrastructure. Keep a secure backup in your primary authenticator; the app has no export or backup feature. Test keys in this repository are public demonstration data.
|
