# Security policy

## Supported versions

Only the current stable minor line receives security fixes:

| Version | Supported |
| ------- | --------- |
| 0.18.x  | Yes |
| 0.17.x  | No |
| 0.16.x  | No |
| 0.15.x  | No |
| older   | No |

Upgrade to the latest release for security and reliability fixes. See [docs/UPDATE.md](docs/UPDATE.md).

## Reporting a vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Email the maintainer at **xavier@bongbetic.com** with subject:

`Voculinux Security Vulnerability Report`

Include:

- Clear description of the issue
- Steps to reproduce
- Potential impact
- Suggested fix (optional)

You should receive acknowledgment within 48 hours. We will assess severity, share an expected timeline, coordinate disclosure, and credit you in release notes if you want credit.

## Privacy design

Voculinux is built for local-first dictation:

- Local engines process audio on-device after you download a model
- No account is required for local engines
- No usage telemetry in the installed application
- Models download once and stay in local cache
- Downloads are checked against pinned checksums before install

### Remote API (optional)

When the user enables **Remote API**, audio is uploaded to the configured server over HTTP(S). That path is off by default. Operators should use TLS and authentication for any network outside a trusted LAN. See [docs/HTTP_REMOTE.md](docs/HTTP_REMOTE.md).

### Engines

| Engine | Processing | Notes |
|--------|------------|--------|
| whisper.cpp (default) | Local | Vulkan GPU optional; models cached under XDG data |
| OpenAI Whisper | Local | PyTorch; NVIDIA/CUDA common |
| Faster Whisper | Local | CTranslate2 / INT8 Whisper on CPU; optional extra |
| VOSK | Local | Lightweight CPU path |
| Parakeet | Local | NVIDIA NeMo ASR via sherpa-onnx; CPU |
| Remote API | User-configured server | Opt-in only |

### File locations

| Path | Purpose | Permissions (typical) |
|------|---------|------------------------|
| `~/.config/voculinux/` | Configuration | User-only (mode 700) |
| `~/.local/share/voculinux/` | Data and models | User-only (mode 700) |

### Known limitations

1. **Text injection** uses tools such as xdotool, wtype, ydotool, or IBus; desktop input APIs have their own privilege model
2. **Global shortcuts** need access to input devices (e.g. evdev on some setups)
3. **Virtual environments** isolate Python packages but do not sandbox the desktop session

## Keeping installs current

On Void Linux, update through the signed xbps repository:

```bash
sudo xbps-install -Su voculinux
```

Source checkouts and other paths are in [docs/UPDATE.md](docs/UPDATE.md).

## Contact

| Topic | Contact |
|-------|---------|
| Security | xavier@bongbetic.com |
| General bugs | https://git.bongbetic.com/xavierk/voculinux/issues |