Jatin K MalikandGitHub
6e02e928ae
* chore(release): prepare v0.7.0-beta ## Version Bump (v0.6.3-beta → v0.7.0-beta) This is a major beta release with significant new features including autostart support, tabbed settings, and improved GPU detection. ### Core Version Files - Updated src/vocalinux/version.py to 0.7.0-beta - Updated pyproject.toml classifiers (already correct - Beta) ### Documentation - Updated README.md with new features, bug fixes, and version references - Updated docs/INSTALL.md with v0.7.0-beta install commands - Updated docs/UPDATE.md with comprehensive 'What's New' section - Updated SECURITY.md supported versions table (0.7.x now supported) ### Website - Updated web/src/app/page.tsx version badge (v0.7.0 Beta) - Updated web/src/app/page.tsx softwareVersion schema - Updated web/package.json version to 0.7.0 - Updated web/src/app/changelog/page.tsx with v0.7.0-beta release entry ### Other Updates - Updated install.sh default tag to v0.7.0-beta - Updated src/vocalinux/main.py error message install command - Updated AGENTS.md branch naming example ## Changes Since v0.6.3-beta ### New Features (13 commits) - Autostart on login support via XDG autostart - Tabbed settings dialog with 5 organized tabs - Intel GPU compatibility detection with automatic CPU fallback - Single instance prevention - Evdev device management to prevent CPU spin - Improved GPU detection avoiding false positives - IBus fallback when daemon not running - Fedora dnf check-update fix - Web SEO - 7 new optimized pages ### Contributors - Jatin K Malik (maintainer) - Antoine Monnet (contributor) - jatinkrmalik (contributor) ### Bug Fixes - #254: Improved GPU detection to avoid false positives - #251: Skip IBus setup when daemon not running - #243: Prevent dnf check-update from exiting script on Fedora - #240: Raise exception on IBus setup failure - #234: Removed leading space from first speech transcription - #242/#253: Removed disconnected evdev devices to prevent CPU spin ## Verification - [x] Lint passed - [x] Black formatting passed - [x] isort check passed - [x] Version imports correctly as 0.7.0-beta * docs: update version history in RELEASE_PROCESS.md Add entries for 0.6.0-beta through 0.7.0-beta to the version history table.
2.8 KiB
2.8 KiB
Security Policy
Supported Versions
| Version | Supported |
|---|---|
| 0.7.x | ✅ |
| 0.6.x | ❌ |
| 0.5.x | ❌ |
| < 0.5 | ❌ |
Reporting a Vulnerability
We take security seriously. If you discover a security vulnerability within Vocalinux, please follow these steps:
Do NOT
- Open a public GitHub issue for security vulnerabilities
- Disclose the vulnerability publicly before it's fixed
Do
-
Email the maintainer directly: Send an email to jatinkrmalik@gmail.com with:
- A clear description of the vulnerability
- Steps to reproduce the issue
- Potential impact assessment
- Any suggested fixes (optional)
-
Use the subject line: "Vocalinux Security Vulnerability Report"
-
Wait for acknowledgment: You should receive a response within 48 hours
What to Expect
- Acknowledgment: We'll confirm receipt within 48 hours
- Assessment: We'll evaluate the severity and impact
- Timeline: We'll provide an estimated fix timeline
- Fix: We'll work on a fix and coordinate disclosure
- Credit: If desired, we'll credit you in the release notes
Security Considerations
Privacy
Vocalinux is designed with privacy in mind:
- Offline by default: whisper.cpp (default), Whisper, and VOSK engines all work completely offline
- Local processing: All speech recognition happens on your device
- No data collection: We don't collect or transmit your voice data
- No telemetry: We don't track usage or behavior
whisper.cpp (Default Engine)
whisper.cpp is the default speech recognition engine:
- High-performance C++ implementation
- Processes completely locally on your machine
- Models are downloaded once and cached locally
- No audio data is sent to external servers
- Supports Vulkan GPU acceleration for AMD, Intel, and NVIDIA GPUs
Whisper AI (OpenAI)
OpenAI's Whisper is also available as an alternative:
- PyTorch-based implementation
- Processes locally on your machine
- Models are downloaded once and cached locally
- No audio data is sent to external servers
File Permissions
The application stores data in:
~/.config/vocalinux/- Configuration (mode 700)~/.local/share/vocalinux/- Data and models (mode 700)
Known Limitations
- Text injection: Uses xdotool/wtype which may have implications for input monitoring
- Keyboard shortcuts: Global keyboard hooks require appropriate permissions
- Virtual environments: Running in a venv provides some isolation
Updates
Keep your installation updated to receive security fixes:
cd vocalinux
git pull origin main
pip install --upgrade -e .
Contact
For security concerns: jatinkrmalik@gmail.com
For general issues: https://github.com/jatinkrmalik/vocalinux/issues