1d4dbe33cc
* chore(release): prepare v0.18.0 Bump version surfaces for the v0.18.0 minor release: version.py, web/package.json + lockfile, softwareVersion schema, SECURITY.md supported-versions table, AUR pkgver/_tag (source and -bin), AppStream metainfo release entry, and the release-history table in RELEASE_PROCESS.md. Docs and site copy for the delta since v0.17.0: README blurb, snap sideload versions in README/INSTALL/UPDATE, CHANGELOG current-stable entry, docs/UPDATE.md What's New with the 0.18 highlights table and per-PR credits, website changelog + desktop-reliability entries, and PRODUCT.md capability lines for Dictation Pad, per-language shortcuts, tray history, overlay, ducking, PipeWire, portal injection, D-Bus activation, custom dictionary, and file transcription. * fix(release): address review findings on the v0.18.0 prep - Keep the checked-in vocalinux-bin PKGBUILD on v0.17.0 so its real AppImage digests stay consistent with its sources; release.yml bumps pkgver/_tag and pins both-arch digests atomically at publish - Qualify the Flatpak release note: PipeWire system-audio capture and RemoteDesktop portal injection are native-install paths - Refresh dateModified on the changelog and desktop-reliability pages - Restore the release-history table order in RELEASE_PROCESS.md - Revert the build-regenerated web/next-env.d.ts route-types reference --------- Co-authored-by: Jatin K Malik <jatinkrmalik@gmail.com>
90 lines
3.1 KiB
Markdown
90 lines
3.1 KiB
Markdown
# Security policy
|
|
|
|
## Supported versions
|
|
|
|
Only the current stable minor line receives security fixes:
|
|
|
|
| Version | Supported |
|
|
| ------- | --------- |
|
|
| 0.18.x | Yes |
|
|
| 0.17.x | No |
|
|
| 0.16.x | No |
|
|
| 0.15.x | No |
|
|
| older | No |
|
|
|
|
Upgrade to the latest release for security and reliability fixes. See [docs/UPDATE.md](docs/UPDATE.md).
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not open a public GitHub issue for security vulnerabilities.
|
|
|
|
**Preferred:** email the maintainer at **jatinkrmalik@gmail.com** with subject:
|
|
|
|
`Vocalinux Security Vulnerability Report`
|
|
|
|
Include:
|
|
|
|
- Clear description of the issue
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Suggested fix (optional)
|
|
|
|
You should receive acknowledgment within 48 hours. We will assess severity, share an expected timeline, coordinate disclosure, and credit you in release notes if you want credit.
|
|
|
|
If email is unavailable, use [GitHub private vulnerability reporting](https://github.com/VocaHQ/vocalinux/security/advisories/new) when enabled for the repository.
|
|
|
|
## Privacy design
|
|
|
|
Vocalinux is built for local-first dictation:
|
|
|
|
- Local engines process audio on-device after you download a model
|
|
- No Voca account is required for local engines
|
|
- No usage telemetry in the installed application
|
|
- Models download once and stay in local cache
|
|
- Downloads are checked against pinned checksums before install
|
|
|
|
### Remote API (optional)
|
|
|
|
When the user enables **Remote API**, audio is uploaded to the configured server over HTTP(S). That path is off by default. Operators should use TLS and authentication for any network outside a trusted LAN. See [docs/HTTP_REMOTE.md](docs/HTTP_REMOTE.md).
|
|
|
|
### Engines
|
|
|
|
| Engine | Processing | Notes |
|
|
|--------|------------|--------|
|
|
| whisper.cpp (default) | Local | Vulkan GPU optional; models cached under XDG data |
|
|
| OpenAI Whisper | Local | PyTorch; NVIDIA/CUDA common |
|
|
| Faster Whisper | Local | CTranslate2 / INT8 Whisper on CPU; optional extra |
|
|
| VOSK | Local | Lightweight CPU path |
|
|
| Parakeet | Local | NVIDIA NeMo ASR via sherpa-onnx; CPU |
|
|
| Remote API | User-configured server | Opt-in only |
|
|
|
|
### File locations
|
|
|
|
| Path | Purpose | Permissions (typical) |
|
|
|------|---------|------------------------|
|
|
| `~/.config/vocalinux/` | Configuration | User-only (mode 700) |
|
|
| `~/.local/share/vocalinux/` | Data and models | User-only (mode 700) |
|
|
|
|
### Known limitations
|
|
|
|
1. **Text injection** uses tools such as xdotool, wtype, ydotool, or IBus; desktop input APIs have their own privilege model
|
|
2. **Global shortcuts** need access to input devices (e.g. evdev on some setups)
|
|
3. **Virtual environments** isolate Python packages but do not sandbox the desktop session
|
|
|
|
## Keeping installs current
|
|
|
|
```bash
|
|
# Re-run the official installer (preserves config and models)
|
|
curl -fsSL https://raw.githubusercontent.com/VocaHQ/vocalinux/main/install.sh -o /tmp/vl.sh
|
|
bash /tmp/vl.sh
|
|
```
|
|
|
|
Or follow [docs/UPDATE.md](docs/UPDATE.md) for source, AUR, AppImage, Snap, and Flatpak paths.
|
|
|
|
## Contact
|
|
|
|
| Topic | Contact |
|
|
|-------|---------|
|
|
| Security | jatinkrmalik@gmail.com |
|
|
| General bugs | https://github.com/VocaHQ/vocalinux/issues |
|