If you found a security problem in Idiot Box, thank you for reporting it responsibly. This file explains how.

We ship fast and small, so only the newest release gets security fixes.

Please do not open a public issue for security problems. Anyone watching the repo could exploit it before a fix is out.

Instead, use private vulnerability reporting:

1. Open this repository on GitHub.
2. Go to the Security tab.
3. Click Report a vulnerability.
4. Tell us what you found, which version you tested, and step-by-step instructions to reproduce it. Screenshots or a short video help a lot.

1. We confirm we got your report.
2. We investigate and figure out how serious it is.
3. We build and release a fix.
4. You get credited in the release notes, unless you would rather stay anonymous.

We will keep you posted along the way. Please give us a fair chance to fix things before talking about the issue publicly.

Idiot Box is a local-first desktop app. Your code, settings, API keys and chat history stay on your machine, so the interesting reports are the ones that break that promise. For example:

• The app sending your data somewhere it should not
• Untrusted content (a web page, a preview, a project file) escaping into the app or your system
• Holes in the main/renderer bridge, the auto-updater, or installer integrity
• Anything that runs code on your machine without you asking for it

• Bugs with no security impact. File those as normal issues, they are still welcome.
• Problems in third-party services, CDNs or AI providers.
• Social engineering, phishing, or physical access to your machine.
• Reports generated by automated scanners with no working proof.

This is an independent project with no budget for bounties. What we can offer is fast fixes, public credit, and genuine thanks.

Security tab private reporting is the fastest route. For anything else, open a regular issue at https://github.com/TheWonderlandStudio/Idiot_Box.