# Security Checklist

## Secrets

- [ ] Subscription URLs are redacted through parser-based logic.
- [ ] Proxy credentials are not logged.
- [ ] Outbound configs with secrets are not printed in diagnostics.
- [ ] Error messages do not include tokens/passwords/userinfo.

## Tauri/webview

- [ ] CSP is enabled.
- [ ] No broad shell permissions added.
- [ ] No direct command execution from UI input.
- [ ] No `dangerouslySetInnerHTML` or equivalent unsafe HTML rendering without sanitization.

## Network fetch

- [ ] Subscription fetch has timeout.
- [ ] URL scheme is restricted.
- [ ] Local/private/link-local/metadata address behavior is explicit.
- [ ] Redirect behavior does not bypass blocked address checks.

## Filesystem

- [ ] Critical writes are atomic where practical.
- [ ] Corrupt config handling does not silently discard user state.
- [ ] Recursive delete has strict path/marker checks.
- [ ] Temp elevated scripts use unpredictable names and safe directory/ACL when practical.

## Windows services

- [ ] Managed service is verified by name and PathName/metadata.
- [ ] Fuzzy candidates are not automatically controlled.
- [ ] UAC cancellation has clear error.
- [ ] Plan-only remains side-effect-free.