# Security policy

**Development software: no production-readiness claim.** Only the current
development branch is maintained; no stable mobile release exists yet.

Do not post vulnerabilities, cookies, private URLs, household records or keys in a
public issue. Contact the community repository's owner through an established
private channel or enable the host's private vulnerability-reporting mechanism
before public distribution. No private reporting mailbox has been supplied; we
will not invent one. If none is available, request a private contact without
including exploit details. Upstream Yuvomi vulnerabilities belong in
[upstream's private reporting channel](https://github.com/ulsklyc/yuvomi/security/advisories/new),
not its public issue tracker. This project cannot promise upstream response times.

Include affected app/OS/WebView/server versions, reproduction steps, impact,
and a minimal sanitized demonstration. Never include real credentials.

## Security model

- The user selects one HTTPS origin, including its port. A valid TLS chain is
  required. No certificate-error bypass, HTTP production mode, or custom scheme
  handler exists. Use a VPN for private-network access.
- Main application navigation is origin-bound. Android also blocks cross-origin
  subresource and POST requests before the network. External links need a native
  choice; dangerous URI schemes are rejected. No exported deep-link receiver exists.
- No `addJavascriptInterface` bridge or native credential store. Android blob
  exports capture at most 25 MB / eight same-origin Blob references using an
  origin-restricted document-start script, then pull bounded chunks with
  `evaluateJavascript` only after a user chooses a destination. Every pull
  rechecks origin and lifecycle. No blob fetch or CSP relaxation is used.
- WebView/WKWebView owns persistent HttpOnly session cookies. Native code neither
  handles passwords nor bypasses the server's CSRF rules. Native Android download
  code obtains a cookie snapshot only for the configured origin and refuses redirects.
- Live microphone, geolocation and media-capture requests are denied. The trusted
  app's file input uses explicit system pickers; Android image capture delegates
  to the camera app with a narrowly scoped content URI and no broad storage access.
- External SSO uses a separate capability-restricted web view and the same OS
  website cookie store. It does not gain app navigation/file handlers. iOS 18.4+
  is required so uploads can be explicitly denied in that untrusted auth window.
- Android backups/device transfer are excluded and screenshots are blocked.
  iOS hides content when inactive and excludes temporary exports from backups.
  OS-managed WKWebView storage remains governed by iOS device/backup protection;
  do not assume the app can exclude every WebKit-managed cookie from an OS backup.
- Server changes stop and destroy the old web context and erase website data.
  Older Android engines that lack complete browsing-data deletion use an OS
  app-data reset, which closes the app. A local wipe is not remote session revocation.
- No app logs contain passwords, tokens, cookie headers or raw network exceptions.
  System/browser diagnostics are outside the app's complete control.

## Limitations and release gates

The configured server and any server-installed extension are trusted same-origin
code. An XSS or malicious administrator remains able to act as the signed-in user;
native origin checks cannot fix compromised application content. Structural metadata
probing does not authenticate the Yuvomi product or expose an anonymous version number.
Embedded SSO providers that reject web views need a browser session instead; no
secure native-session handoff exists upstream. A future handoff needs upstream
review and single-use, short-lived, session-bound exchange semantics.

Downloaded files saved by the user remain outside app erasure. Android network
downloads are capped at 100 MB / 120 seconds; generated blob exports at 25 MB /
45 seconds. iOS checks declared size before downloads and actual size before
export (100 MB); an unknown/chunked size may consume disk before rejection.
This resource-limit gap requires review and device testing before release.

Android WebView Safe Browsing remains enabled. The installed engine/OS may perform
its own security checks; this app does not implement or log those network services.
Keep the OS and WebView patched. OSV advisory checks are build-time, never runtime,
and do not prove the absence of vulnerabilities. See `docs/security-review.md`.