SHA256
Yuvomi Mobile Contributors
2d12491516
Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.
70 lines
4.5 KiB
Markdown
70 lines
4.5 KiB
Markdown
# Security policy
|
|
|
|
**Development software: no production-readiness claim.** Only the current
|
|
development branch is maintained; no stable mobile release exists yet.
|
|
|
|
Do not post vulnerabilities, cookies, private URLs, household records or keys in a
|
|
public issue. Contact the community repository's owner through an established
|
|
private channel or enable the host's private vulnerability-reporting mechanism
|
|
before public distribution. No private reporting mailbox has been supplied; we
|
|
will not invent one. If none is available, request a private contact without
|
|
including exploit details. Upstream Yuvomi vulnerabilities belong in
|
|
[upstream's private reporting channel](https://github.com/ulsklyc/yuvomi/security/advisories/new),
|
|
not its public issue tracker. This project cannot promise upstream response times.
|
|
|
|
Include affected app/OS/WebView/server versions, reproduction steps, impact,
|
|
and a minimal sanitized demonstration. Never include real credentials.
|
|
|
|
## Security model
|
|
|
|
- The user selects one HTTPS origin, including its port. A valid TLS chain is
|
|
required. No certificate-error bypass, HTTP production mode, or custom scheme
|
|
handler exists. Use a VPN for private-network access.
|
|
- Main application navigation is origin-bound. Android also blocks cross-origin
|
|
subresource and POST requests before the network. External links need a native
|
|
choice; dangerous URI schemes are rejected. No exported deep-link receiver exists.
|
|
- No `addJavascriptInterface` bridge or native credential store. Android blob
|
|
exports capture at most 25 MB / eight same-origin Blob references using an
|
|
origin-restricted document-start script, then pull bounded chunks with
|
|
`evaluateJavascript` only after a user chooses a destination. Every pull
|
|
rechecks origin and lifecycle. No blob fetch or CSP relaxation is used.
|
|
- WebView/WKWebView owns persistent HttpOnly session cookies. Native code neither
|
|
handles passwords nor bypasses the server's CSRF rules. Native Android download
|
|
code obtains a cookie snapshot only for the configured origin and refuses redirects.
|
|
- Live microphone, geolocation and media-capture requests are denied. The trusted
|
|
app's file input uses explicit system pickers; Android image capture delegates
|
|
to the camera app with a narrowly scoped content URI and no broad storage access.
|
|
- External SSO uses a separate capability-restricted web view and the same OS
|
|
website cookie store. It does not gain app navigation/file handlers. iOS 18.4+
|
|
is required so uploads can be explicitly denied in that untrusted auth window.
|
|
- Android backups/device transfer are excluded and screenshots are blocked.
|
|
iOS hides content when inactive and excludes temporary exports from backups.
|
|
OS-managed WKWebView storage remains governed by iOS device/backup protection;
|
|
do not assume the app can exclude every WebKit-managed cookie from an OS backup.
|
|
- Server changes stop and destroy the old web context and erase website data.
|
|
Older Android engines that lack complete browsing-data deletion use an OS
|
|
app-data reset, which closes the app. A local wipe is not remote session revocation.
|
|
- No app logs contain passwords, tokens, cookie headers or raw network exceptions.
|
|
System/browser diagnostics are outside the app's complete control.
|
|
|
|
## Limitations and release gates
|
|
|
|
The configured server and any server-installed extension are trusted same-origin
|
|
code. An XSS or malicious administrator remains able to act as the signed-in user;
|
|
native origin checks cannot fix compromised application content. Structural metadata
|
|
probing does not authenticate the Yuvomi product or expose an anonymous version number.
|
|
Embedded SSO providers that reject web views need a browser session instead; no
|
|
secure native-session handoff exists upstream. A future handoff needs upstream
|
|
review and single-use, short-lived, session-bound exchange semantics.
|
|
|
|
Downloaded files saved by the user remain outside app erasure. Android network
|
|
downloads are capped at 100 MB / 120 seconds; generated blob exports at 25 MB /
|
|
45 seconds. iOS checks declared size before downloads and actual size before
|
|
export (100 MB); an unknown/chunked size may consume disk before rejection.
|
|
This resource-limit gap requires review and device testing before release.
|
|
|
|
Android WebView Safe Browsing remains enabled. The installed engine/OS may perform
|
|
its own security checks; this app does not implement or log those network services.
|
|
Keep the OS and WebView patched. OSV advisory checks are build-time, never runtime,
|
|
and do not prove the absence of vulnerabilities. See `docs/security-review.md`.
|