Security
Security model#
- No network listener — user-owned Unix socket (macOS) / DACL-sealed named pipe (Windows) only.
- Sender identity verified by kernel peer pid (self-report distrusted) · role→role ACL · See "Reporting a vulnerability" below for how to report an issue, and Architecture & Philosophy §6 for more detail.
Reporting a vulnerability#
Please report security issues privately to cysinsight@gmail.com. Do not open public issues for vulnerabilities. You should receive a response within a few days; coordinated disclosure is appreciated.
Scope notes#
- The desktop app talks to a local daemon (
cysd) over a user-owned Unix socket (macOS/Linux) or a DACL-sealed named pipe (Windows). No network listener is opened. - Updates are verified: app binaries via Tauri updater signatures, packs via
minisign (
pack-manifest.json.minisig, key pinned in the binary). - External URL opening is gated by a hard host allowlist
(
~/.cys/url-allow-hosts/CYS_URL_ALLOW_HOSTSextend it locally only). - A pre-publish secret/PII gate exists at
scripts/secret-scan.sh --all(fail-closed; static pattern matching — see its header for honest limits).
Deeper detail on the threat model and role-based access control: Architecture & Philosophy §6.
Back to Overview