# Security policy

## Supported version

Security fixes are applied to the latest commit on `main`. This project has not published a stable semantic-versioned release yet.

## Reporting a vulnerability

Please use [GitHub private vulnerability reporting](https://github.com/susirial/dsh-traebao/security/advisories/new) when available. If the repository does not offer that form, contact the repository owner through the email listed on the [GitHub profile](https://github.com/susirial).

Do not open a public issue for:

- path traversal or arbitrary file read/write;
- same-origin or authorization bypasses;
- unsafe Electron access;
- malicious media that bypasses validation;
- disclosure of DSH settings, workspace data, or local paths.

Include a minimal reproduction, affected commit, platform, impact, and suggested mitigation. Remove API keys, credentials, conversation content, and personal paths.

## Security model

TRAE Bao:

- binds its HTTP routes to the existing DSH Host WebServer;
- requires same-origin requests for mutations;
- accepts only allowlisted resource paths and media formats;
- checks file size and media magic bytes before persistence;
- atomically writes user assets with private permissions;
- keeps Electron access in an optional Host-only picker;
- performs no telemetry or external network requests.

The plugin still runs with the permissions of the local DSH Host. Install only code and assets you trust.