Jatin K MalikandGitHub
f48bdda525
* docs: polish project documentation for a clearer public surface Rewrite the README and supporting docs for a more professional first impression: less emoji and badge noise, install-first structure, and a real documentation index. Add a Contributor Covenant, tighten SECURITY and GitHub templates, and make distro/update guides read as product docs instead of internal status notes. * docs: split install guide and add changelog plus support pages Break INSTALL.md into a short primary guide, manual/PyPI package lists, and troubleshooting. Add root CHANGELOG.md and SUPPORT.md, wire them into the docs index and README, and drop the outdated screenshot lag note now that v0.15 assets are on main. * docs: humanize PR copy and remove em dashes Strip em/en dashes from the documentation rewritten in this PR, fix mid-sentence colon fallout from that pass, and smooth a few stiff phrases so the public docs read more natural. * docs: list Faster Whisper after rebase onto main Installer and CLI already accept faster_whisper. Document it next to the other engines, drop the outdated screenshot lag note, and keep the on-device wording honest for local vs remote.
3.0 KiB
Security policy
Supported versions
Only the current stable minor line receives security fixes:
| Version | Supported |
|---|---|
| 0.16.x | Yes |
| 0.15.x | No |
| 0.14.x | No |
| older | No |
Upgrade to the latest release for security and reliability fixes. See docs/UPDATE.md.
Reporting a vulnerability
Do not open a public GitHub issue for security vulnerabilities.
Preferred: email the maintainer at jatinkrmalik@gmail.com with subject:
Vocalinux Security Vulnerability Report
Include:
- Clear description of the issue
- Steps to reproduce
- Potential impact
- Suggested fix (optional)
You should receive acknowledgment within 48 hours. We will assess severity, share an expected timeline, coordinate disclosure, and credit you in release notes if you want credit.
If email is unavailable, use GitHub private vulnerability reporting when enabled for the repository.
Privacy design
Vocalinux is built for local-first dictation:
- Local engines process audio on-device after you download a model
- No Voca account is required for local engines
- No usage telemetry in the installed application
- Models download once and stay in local cache
- Downloads are checked against pinned checksums before install
Remote API (optional)
When the user enables Remote API, audio is uploaded to the configured server over HTTP(S). That path is off by default. Operators should use TLS and authentication for any network outside a trusted LAN. See docs/HTTP_REMOTE.md.
Engines
| Engine | Processing | Notes |
|---|---|---|
| whisper.cpp (default) | Local | Vulkan GPU optional; models cached under XDG data |
| OpenAI Whisper | Local | PyTorch; NVIDIA/CUDA common |
| VOSK | Local | Lightweight CPU path |
| Parakeet | Local | NVIDIA NeMo ASR via sherpa-onnx; CPU |
| Remote API | User-configured server | Opt-in only |
File locations
| Path | Purpose | Permissions (typical) |
|---|---|---|
~/.config/vocalinux/ |
Configuration | User-only (mode 700) |
~/.local/share/vocalinux/ |
Data and models | User-only (mode 700) |
Known limitations
- Text injection uses tools such as xdotool, wtype, ydotool, or IBus; desktop input APIs have their own privilege model
- Global shortcuts need access to input devices (e.g. evdev on some setups)
- Virtual environments isolate Python packages but do not sandbox the desktop session
Keeping installs current
# Re-run the official installer (preserves config and models)
curl -fsSL https://raw.githubusercontent.com/VocaHQ/vocalinux/main/install.sh -o /tmp/vl.sh
bash /tmp/vl.sh
Or follow docs/UPDATE.md for source, AUR, AppImage, Snap, and Flatpak paths.
Contact
| Topic | Contact |
|---|---|
| Security | jatinkrmalik@gmail.com |
| General bugs | https://github.com/VocaHQ/vocalinux/issues |