Jatin K MalikandGitHub
d004a401af
This commit prepares the repository for the v0.5.0-beta release, transitioning from alpha to beta status. Changes made: - Update version from 0.4.1-alpha to 0.5.0-beta in version.py - Update Development Status classifier from Alpha to Beta in pyproject.toml and setup.py - Update status badges from Alpha (orange) to Beta (blue) in README.md - Update all installation command examples to use v0.5.0-beta tag - Update release announcement from Alpha to Beta in README.md - Add RELEASE_PROCESS.md documentation for future releases - Update docs/INSTALL.md with new version references - Add What's New section for v0.5.0-beta in docs/UPDATE.md - Update SECURITY.md supported versions table - Update website schema softwareVersion in layout.tsx - Update website version badges in page.tsx - Update website package.json version to 0.5.0 Testing: - All 463 tests passing (100%) - Version consistency verified across all files Release process documentation added to docs/RELEASE_PROCESS.md
2.4 KiB
2.4 KiB
Security Policy
Supported Versions
| Version | Supported |
|---|---|
| 0.5.x | ✅ |
| 0.4.x | ❌ |
| < 0.4 | ❌ |
Reporting a Vulnerability
We take security seriously. If you discover a security vulnerability within Vocalinux, please follow these steps:
Do NOT
- Open a public GitHub issue for security vulnerabilities
- Disclose the vulnerability publicly before it's fixed
Do
-
Email the maintainer directly: Send an email to jatinkrmalik@gmail.com with:
- A clear description of the vulnerability
- Steps to reproduce the issue
- Potential impact assessment
- Any suggested fixes (optional)
-
Use the subject line: "Vocalinux Security Vulnerability Report"
-
Wait for acknowledgment: You should receive a response within 48 hours
What to Expect
- Acknowledgment: We'll confirm receipt within 48 hours
- Assessment: We'll evaluate the severity and impact
- Timeline: We'll provide an estimated fix timeline
- Fix: We'll work on a fix and coordinate disclosure
- Credit: If desired, we'll credit you in the release notes
Security Considerations
Privacy
Vocalinux is designed with privacy in mind:
- Offline by default: Both Whisper (default) and VOSK engines work completely offline
- Local processing: All speech recognition happens on your device
- No data collection: We don't collect or transmit your voice data
- No telemetry: We don't track usage or behavior
Whisper AI (Default Engine)
Whisper is the default speech recognition engine:
- Whisper processes locally on your machine
- Models are downloaded once and cached locally
- No audio data is sent to external servers
File Permissions
The application stores data in:
~/.config/vocalinux/- Configuration (mode 700)~/.local/share/vocalinux/- Data and models (mode 700)
Known Limitations
- Text injection: Uses xdotool/wtype which may have implications for input monitoring
- Keyboard shortcuts: Global keyboard hooks require appropriate permissions
- Virtual environments: Running in a venv provides some isolation
Updates
Keep your installation updated to receive security fixes:
cd vocalinux
git pull origin main
pip install --upgrade -e .
Contact
For security concerns: jatinkrmalik@gmail.com
For general issues: https://github.com/jatinkrmalik/vocalinux/issues