# Security Policy

## Supported versions

| Version | Supported |
|---|---|
| 1.1.x | ✅ |
| 1.0.x | ⚠️ superseded (single-root whitelist; env-var based) — upgrade to 1.1.x |

## Security model (summary)

- **Loopback-only** image route; the route URL prefix is assembled at runtime from the web server's host/port — the source contains **zero URL literals** (build-gate enforced).
- **Sole enforcement point**: every image read passes the route handler — token (256-bit, `crypto.randomBytes`) → extension whitelist (9 formats) → **multi-root realpath containment** (session workspace + paste root + user-added settings roots) → regular-file stat → byte-size limit.
- Stream rewriting is display-only and re-validates every candidate through the same guard.
- Error responses are fixed short strings; paths/tokens are never echoed. Client code has zero filesystem access.
- Full 4-stage self-audit: [`docs/SELF-AUDIT.md`](docs/SELF-AUDIT.md) (zero high-risk findings; documented residual risks R1–R7).

**Key accepted risk**: `<img>` requests carry no Origin header, so the token is the sole gate. Keep the GUI on loopback (the default). If you run DSH with `--host 0.0.0.0`, the route is LAN-reachable (still token-gated).

## Reporting a vulnerability

Please do **not** open a public issue for security vulnerabilities.

1. **Preferred**: use GitHub's private vulnerability reporting — [Report a vulnerability](https://github.com/zehenk/dsh-tu4-inline-images/security/advisories/new) (requires the repository owner to enable private vulnerability reporting in repo settings).
2. **Alternative**: email the repository owner; reference "security report" in the subject.

What to include: affected version, reproduction steps (ideally against a scratch DSH profile), and the security impact you observed.

We aim to acknowledge reports within 3 days and to ship a fix in the next patch release, with credit unless you prefer anonymity.