37 lines
1.2 KiB
Markdown
37 lines
1.2 KiB
Markdown
# Security Checklist
|
|
|
|
## Secrets
|
|
|
|
- [ ] Subscription URLs are redacted through parser-based logic.
|
|
- [ ] Proxy credentials are not logged.
|
|
- [ ] Outbound configs with secrets are not printed in diagnostics.
|
|
- [ ] Error messages do not include tokens/passwords/userinfo.
|
|
|
|
## Tauri/webview
|
|
|
|
- [ ] CSP is enabled.
|
|
- [ ] No broad shell permissions added.
|
|
- [ ] No direct command execution from UI input.
|
|
- [ ] No `dangerouslySetInnerHTML` or equivalent unsafe HTML rendering without sanitization.
|
|
|
|
## Network fetch
|
|
|
|
- [ ] Subscription fetch has timeout.
|
|
- [ ] URL scheme is restricted.
|
|
- [ ] Local/private/link-local/metadata address behavior is explicit.
|
|
- [ ] Redirect behavior does not bypass blocked address checks.
|
|
|
|
## Filesystem
|
|
|
|
- [ ] Critical writes are atomic where practical.
|
|
- [ ] Corrupt config handling does not silently discard user state.
|
|
- [ ] Recursive delete has strict path/marker checks.
|
|
- [ ] Temp elevated scripts use unpredictable names and safe directory/ACL when practical.
|
|
|
|
## Windows services
|
|
|
|
- [ ] Managed service is verified by name and PathName/metadata.
|
|
- [ ] Fuzzy candidates are not automatically controlled.
|
|
- [ ] UAC cancellation has clear error.
|
|
- [ ] Plan-only remains side-effect-free.
|