LunoRX
← Back to home

Security

Last updated: October 24, 2026

If you find a security problem, please report it privately. Do not open a public issue or pull request.

How to report

  • Open the Security tab of the repository (https://github.com/LunoRX-RS/desktop/security) and choose Report a vulnerability. Only the maintainers can see the report.
  • Tell us which part is affected, which version or commit you tested, the steps to repeat the problem, and the impact you expect.
  • Do not attach real logins, tokens or user data. Hide them first.

Supported versions

  • The app is in a test phase (1.0.0-rc.x). Only the latest release candidate and the main branch are maintained.

Principles

  • Logins and tokens must never appear in logs or in messages passed between parts of the app, and must stay in protected system storage.
  • The app's device-level permissions are limited and never exposed to outside web content.
  • The YouTube sign-in window can only open Google and YouTube pages.
  • Every command inside the app is declared and its input is checked. Errors are shown as general categories, with no raw messages or internal details.