nessi
454cad95c5
Add .gitignore, GitLab CI pipeline with test/lint/build/release stages, project documentation (README, LICENSE, CHANGELOG, CONTRIBUTING, SECURITY), PyInstaller packaging configuration with icon and version info, Python project configuration with dependencies, and complete application source including battery provider, device discovery, settings management, UI components, startup control, and comprehensive test suite
33 lines
1.5 KiB
Markdown
33 lines
1.5 KiB
Markdown
# Security
|
|
|
|
## Design guarantees
|
|
|
|
Logitech Battery Widget performs local, read-only HID device enumeration and HID++ feature queries.
|
|
It has no networking code, telemetry, analytics, updater, runtime downloads, obfuscation, anti-VM
|
|
logic, browser access, credential access, service installation, elevation request, or UAC manifest.
|
|
It does not require administrator privileges.
|
|
|
|
The application writes only:
|
|
|
|
- `%APPDATA%\LogitechBatteryWidget\config.json`
|
|
- `%LOCALAPPDATA%\LogitechBatteryWidget\logs\app.log` and three rotated backups
|
|
- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\LogitechBatteryWidget`, but only after the
|
|
user checks **Start with Windows**. Unchecking it deletes that value.
|
|
|
|
Logs contain timestamps, severity, module names, and diagnostic messages. Device serial numbers,
|
|
paths, user names, configuration content, credentials, and HID report bytes are not logged.
|
|
|
|
PyInstaller may unpack its one-file bundle into its standard temporary directory while running.
|
|
The project creates no other temporary payloads. UPX is disabled.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Open a confidential GitLab issue with affected versions, reproduction steps, and impact. Do not
|
|
publish credentials, serial numbers, or personal paths. Maintainers should acknowledge reports
|
|
within seven days and coordinate a fix before public disclosure.
|
|
|
|
## Release verification
|
|
|
|
Release jobs publish a SHA-256 checksum beside the executable. The CI configuration and PyInstaller
|
|
spec are versioned, allowing anyone to rebuild from source and inspect every included dependency.
|