nessi
454cad95c5
Add .gitignore, GitLab CI pipeline with test/lint/build/release stages, project documentation (README, LICENSE, CHANGELOG, CONTRIBUTING, SECURITY), PyInstaller packaging configuration with icon and version info, Python project configuration with dependencies, and complete application source including battery provider, device discovery, settings management, UI components, startup control, and comprehensive test suite
1.5 KiB
Security
Design guarantees
Logitech Battery Widget performs local, read-only HID device enumeration and HID++ feature queries. It has no networking code, telemetry, analytics, updater, runtime downloads, obfuscation, anti-VM logic, browser access, credential access, service installation, elevation request, or UAC manifest. It does not require administrator privileges.
The application writes only:
%APPDATA%\LogitechBatteryWidget\config.json%LOCALAPPDATA%\LogitechBatteryWidget\logs\app.logand three rotated backupsHKCU\Software\Microsoft\Windows\CurrentVersion\Run\LogitechBatteryWidget, but only after the user checks Start with Windows. Unchecking it deletes that value.
Logs contain timestamps, severity, module names, and diagnostic messages. Device serial numbers, paths, user names, configuration content, credentials, and HID report bytes are not logged.
PyInstaller may unpack its one-file bundle into its standard temporary directory while running. The project creates no other temporary payloads. UPX is disabled.
Reporting a vulnerability
Open a confidential GitLab issue with affected versions, reproduction steps, and impact. Do not publish credentials, serial numbers, or personal paths. Maintainers should acknowledge reports within seven days and coordinate a fix before public disclosure.
Release verification
Release jobs publish a SHA-256 checksum beside the executable. The CI configuration and PyInstaller spec are versioned, allowing anyone to rebuild from source and inspect every included dependency.