We take security seriously. If you discover a security vulnerability, please follow these steps:

1. Do NOT create a public GitHub issue for security vulnerabilities
2. Email security concerns to the maintainers (see MAINTAINERS.md)
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact assessment
   • Affected versions
   • Suggested fix (if any)

Severity Definitions:

• Critical: Remote code execution, data breach, authentication bypass
• High: Privilege escalation, significant data exposure
• Medium: Information disclosure, CSRF
• Low: Minor information leakage, best practice violations

• Local Storage: All data stored locally using CubDB (no cloud)
• Encryption: XChaCha20-Poly1305 for sensitive data (optional)
• Password Hashing: Argon2id for any authentication
• No Telemetry: No data sent to external servers

• Student submissions processed locally only
• No submission data leaves the tutor's machine
• Temporary files cleaned up after processing

• Default: Localhost-only web interface
• No external network calls required
• Optional: Post-quantum key exchange (Kyber)

• Elixir/BEAM fault tolerance
• No native code dependencies (pure Elixir where possible)
• WASM sandbox for plugins
• Dependencies audited regularly

1. Keep Updated: Use the latest version
2. File Permissions: Protect data directory
3. Network: Keep on localhost unless needed
4. Backups: Enable automatic backups
5. Passwords: Use strong passwords if auth enabled

1. Report received and acknowledged
2. Vulnerability verified and assessed
3. Fix developed and tested
4. Patch released with advisory
5. Public disclosure after patch

Last updated: 2024-12-01