xavierk
731b919865
Version 0.19.0 across version.py, the Void template and the synced docs; changelog entry; Gitea project URLs in pyproject.toml; per-backend ladder thresholds measured in #19; the xbps release workflow is manual-only, and packaging/void/publish-release.sh publishes a locally built, verified repository to the Gitea releases.
89 lines
2.8 KiB
Markdown
89 lines
2.8 KiB
Markdown
# Security policy
|
|
|
|
## Supported versions
|
|
|
|
Only the current stable minor line receives security fixes:
|
|
|
|
| Version | Supported |
|
|
| ------- | --------- |
|
|
| 0.19.x | Yes |
|
|
| 0.18.x | No |
|
|
| 0.17.x | No |
|
|
| 0.16.x | No |
|
|
| 0.15.x | No |
|
|
| older | No |
|
|
|
|
Upgrade to the latest release for security and reliability fixes. See [docs/UPDATE.md](docs/UPDATE.md).
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not open a public GitHub issue for security vulnerabilities.
|
|
|
|
Email the maintainer at **xavier@bongbetic.com** with subject:
|
|
|
|
`Voculinux Security Vulnerability Report`
|
|
|
|
Include:
|
|
|
|
- Clear description of the issue
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Suggested fix (optional)
|
|
|
|
You should receive acknowledgment within 48 hours. We will assess severity, share an expected timeline, coordinate disclosure, and credit you in release notes if you want credit.
|
|
|
|
## Privacy design
|
|
|
|
Voculinux is built for local-first dictation:
|
|
|
|
- Local engines process audio on-device after you download a model
|
|
- No account is required for local engines
|
|
- No usage telemetry in the installed application
|
|
- Models download once and stay in local cache
|
|
- Downloads are checked against pinned checksums before install
|
|
|
|
### Remote API (optional)
|
|
|
|
When the user enables **Remote API**, audio is uploaded to the configured server over HTTP(S). That path is off by default. Operators should use TLS and authentication for any network outside a trusted LAN. See [docs/HTTP_REMOTE.md](docs/HTTP_REMOTE.md).
|
|
|
|
### Engines
|
|
|
|
| Engine | Processing | Notes |
|
|
|--------|------------|--------|
|
|
| whisper.cpp (default) | Local | Vulkan GPU optional; models cached under XDG data |
|
|
| OpenAI Whisper | Local | PyTorch; NVIDIA/CUDA common |
|
|
| Faster Whisper | Local | CTranslate2 / INT8 Whisper on CPU; optional extra |
|
|
| VOSK | Local | Lightweight CPU path |
|
|
| Parakeet | Local | NVIDIA NeMo ASR via sherpa-onnx; CPU |
|
|
| Remote API | User-configured server | Opt-in only |
|
|
|
|
### File locations
|
|
|
|
| Path | Purpose | Permissions (typical) |
|
|
|------|---------|------------------------|
|
|
| `~/.config/voculinux/` | Configuration | User-only (mode 700) |
|
|
| `~/.local/share/voculinux/` | Data and models | User-only (mode 700) |
|
|
|
|
### Known limitations
|
|
|
|
1. **Text injection** uses tools such as xdotool, wtype, ydotool, or IBus; desktop input APIs have their own privilege model
|
|
2. **Global shortcuts** need access to input devices (e.g. evdev on some setups)
|
|
3. **Virtual environments** isolate Python packages but do not sandbox the desktop session
|
|
|
|
## Keeping installs current
|
|
|
|
On Void Linux, update through the signed xbps repository:
|
|
|
|
```bash
|
|
sudo xbps-install -Su voculinux
|
|
```
|
|
|
|
Source checkouts and other paths are in [docs/UPDATE.md](docs/UPDATE.md).
|
|
|
|
## Contact
|
|
|
|
| Topic | Contact |
|
|
|-------|---------|
|
|
| Security | xavier@bongbetic.com |
|
|
| General bugs | https://git.bongbetic.com/xavierk/voculinux/issues |
|