fbb81238f5
* chore(release): prepare v0.15.0 Bump version across app, web, AUR, and Flatpak metainfo. Document GitHub release-notes rules, refresh README/UPDATE/INSTALL/USER_GUIDE for the 0.15 series (sidebar settings, AppImage, auto-pause/keepalive, Vulkan device selection), and align website product surfaces with shipped features. Co-authored-by: Jatin K Malik <jatinkrmalik@users.noreply.github.com> * docs(release): fold latest main into v0.15.0 notes Include dictation capitalization/trailing-space, ibus-wayland injection, IBus teardown, and settings notice polish landed on main after the initial release prep rebase. Co-authored-by: Jatin K Malik <jatinkrmalik@users.noreply.github.com> * docs(release): include Bluetooth mic crash fix in v0.15.0 notes Fold #599 (PortAudio Bluetooth SCO probe heap corruption) into README, UPDATE, changelog, AppStream, and release history after rebasing onto main. Co-authored-by: Jatin K Malik <jatinkrmalik@users.noreply.github.com> * docs(release): include language catalog expansion in v0.15.0 notes Fold #616 (Hungarian and expanded speech languages, Fixes #565) into README, UPDATE, changelog, AppStream, PRODUCT.md, and release history after rebasing onto latest main. Co-authored-by: Jatin K Malik <jatinkrmalik@users.noreply.github.com> * docs(release): fold settings footer and language follow-ups into v0.15.0 Include #618 sidebar dictation footer, #619 Custom Shortcut Record/Set restore, and #617 English (India) Whisper language mapping after rebasing onto latest main. Co-authored-by: Jatin K Malik <jatinkrmalik@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Jatin K Malik <jatinkrmalik@users.noreply.github.com>
3.0 KiB
3.0 KiB
Security Policy
Supported Versions
| Version | Supported |
|---|---|
| 0.15.x | ✅ |
| 0.14.x | ❌ |
| 0.13.x | ❌ |
| 0.12.x | ❌ |
| 0.11.x | ❌ |
| 0.10.x | ❌ |
| 0.9.x | ❌ |
| 0.8.x | ❌ |
| < 0.8 | ❌ |
Reporting a Vulnerability
We take security seriously. If you discover a security vulnerability within Vocalinux, please follow these steps:
Do NOT
- Open a public GitHub issue for security vulnerabilities
- Disclose the vulnerability publicly before it's fixed
Do
-
Email the maintainer directly: Send an email to jatinkrmalik@gmail.com with:
- A clear description of the vulnerability
- Steps to reproduce the issue
- Potential impact assessment
- Any suggested fixes (optional)
-
Use the subject line: "Vocalinux Security Vulnerability Report"
-
Wait for acknowledgment: You should receive a response within 48 hours
What to Expect
- Acknowledgment: We'll confirm receipt within 48 hours
- Assessment: We'll evaluate the severity and impact
- Timeline: We'll provide an estimated fix timeline
- Fix: We'll work on a fix and coordinate disclosure
- Credit: If desired, we'll credit you in the release notes
Security Considerations
Privacy
Vocalinux is designed with privacy in mind:
- Offline by default: whisper.cpp (default), Whisper, and VOSK engines all work completely offline
- Local processing: All speech recognition happens on your device
- No data collection: We don't collect or transmit your voice data
- No telemetry: We don't track usage or behavior
whisper.cpp (Default Engine)
whisper.cpp is the default speech recognition engine:
- High-performance C++ implementation
- Processes completely locally on your machine
- Models are downloaded once and cached locally
- No audio data is sent to external servers
- Supports Vulkan GPU acceleration for AMD, Intel, and NVIDIA GPUs
Whisper AI (OpenAI)
OpenAI's Whisper is also available as an alternative:
- PyTorch-based implementation
- Processes locally on your machine
- Models are downloaded once and cached locally
- No audio data is sent to external servers
File Permissions
The application stores data in:
~/.config/vocalinux/- Configuration (mode 700)~/.local/share/vocalinux/- Data and models (mode 700)
Known Limitations
- Text injection: Uses xdotool/wtype which may have implications for input monitoring
- Keyboard shortcuts: Global keyboard hooks require appropriate permissions
- Virtual environments: Running in a venv provides some isolation
Updates
Keep your installation updated to receive security fixes:
cd vocalinux
git pull origin main
pip install --upgrade -e .
Contact
For security concerns: jatinkrmalik@gmail.com
For general issues: https://github.com/jatinkrmalik/vocalinux/issues