| Version | Supported |
|---|---|
| 0.0.x | ( In active dev) |
This project is in early development (v0.0.1) with no users or production data. If you discover a security issue, please report it privately to:
Do not open a public GitHub issue for the vulnerability.
You can expect:
- Acknowledgment within 48 hours
- A fix timeline discussed with you
Trachyte is a local-first application. No user data leaves the device by default. The threat model assumes an attacker with local filesystem access.
- No telemetry
- No automatic outbound network calls
- CSP:
default-src 'self'
- Local filesystem access: Vault files are standard Markdown — no proprietary format
- Network: No outbound connections by default (sync is opt-in, Phase 4+)
- IPC: All file operations go through validated
trachyte-fs— no raw paths in IPC - Editor: CodeMirror 6 runs in a sandboxed WebView with strict CSP
- Issues will be acknowledged within 48 hours
- Fix will be prioritized based on severity
- Public disclosure after a fix is available (typically 30 days)