# Security Policy

## Supported status

Chanora is not production-ready yet. Security reports are still welcome during early development.

## Reporting a vulnerability

Do not open public issues for sensitive security reports.

Until a private security channel is established, report security concerns directly to the project maintainer through the agreed private contact channel.

## Sensitive areas

Important security areas include:

- identity private keys and identity material;
- server passwords;
- platform secure storage;
- local database contents;
- diagnostic logs and export bundles;
- protocol input from compatible servers;
- Flutter/Rust bridge DTO validation;
- audio permission behavior;
- dependency and supply-chain integrity;
- OSS license and attribution compliance.

## Security gates before public release

Before any public or store release, the following documents must be completed and reviewed:

```text
docs/security/threat-model.md
docs/security/secure-storage-audit-report.md
docs/security/diagnostic-redaction-audit-report.md
docs/security/dependency-and-supply-chain-report.md
docs/privacy/privacy-policy.md
docs/legal/trademark-and-attribution-review.md
```

## Secret handling rule

Secrets must not be stored in plaintext local storage or written to logs.

Secrets include:

- server passwords;
- identity private keys;
- authentication tokens if later added;
- secure-storage keys;
- signing credentials.