We release patches for security vulnerabilities in the following versions:

We take the security of Bando-Fi AI seriously. If you discover a security vulnerability, please follow these steps:

Please do not publicly disclose the vulnerability until we've had a chance to address it.

Send details to:

• Email: security@massivemagnetics.com (if available)
• GitHub Security Advisory: Use the "Security" tab in this repository

Your report should include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)
• Your contact information

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 7 days
  • High: 14 days
  • Medium: 30 days
  • Low: 90 days

• Content Security Policy (CSP) headers
• HTTPS enforcement in production
• Secure cookie handling
• XSS protection
• Input validation and sanitization

• Context isolation enabled
• Node integration disabled in renderer
• Preload scripts for IPC
• Secure external link handling
• Code signing (when configured)

• HTTPS-only networking
• Secure storage for sensitive data
• Platform permission management
• Certificate pinning (recommended)
• ProGuard/R8 (Android)

• Never commit API keys to repository
• Use environment variables
• Rotate keys regularly
• Implement rate limiting

• TLS/SSL for all communications
• Certificate validation
• Secure headers
• CORS configuration

• Regular dependency updates
• Vulnerability scanning (npm audit)
• Minimal dependency tree
• Trusted sources only

• Windows: Authenticode signing
• macOS: Developer ID signing
• iOS: App Store signing
• Android: APK signing

1. Keep Dependencies Updated

   npm audit
   npm audit fix

2. Use Environment Variables

   # Never do this
   const API_KEY = "abc123...";
   
   # Do this instead
   const API_KEY = process.env.GEMINI_API_KEY;

3. Validate Input

   // Validate and sanitize all user input
   function sanitizeInput(input: string): string {
     return input.trim().replace(/[<>]/g, '');
   }

4. Secure IPC (Electron)

   // Use contextBridge in preload
   contextBridge.exposeInMainWorld('api', {
     // Expose only what's needed
   });

1. Download from Official Sources

   • GitHub Releases
   • Official website
   • Verified app stores

2. Verify Signatures

   • Check code signatures on downloads
   • Verify checksums when provided

3. Keep Updated

   • Install security updates promptly
   • Enable auto-update when available

4. Use Strong API Keys

   • Don't share API keys
   • Use separate keys for dev/prod
   • Monitor key usage

Before each release:

• Run security audit (npm audit)
• Update dependencies with known vulnerabilities
• Review and update CSP headers
• Verify API keys are not exposed
• Test authentication/authorization
• Verify HTTPS enforcement
• Test input validation
• Review error messages (no sensitive info)
• Check file upload restrictions
• Verify secure cookie settings
• Test CSP and security headers
• Run OWASP ZAP or similar scanner
• Code review for security issues
• Sign builds with valid certificates

The application requires a Gemini API key. Users must:

• Obtain their own API key
• Store it securely
• Never commit it to version control
• Use environment variables

• Service worker caches may store sensitive data
• Clear cache when logging out
• Use private browsing for sensitive operations

• User data stored in app data directory
• Encrypt sensitive files
• Clear data on uninstall (optional)

• Platform keychain/keystore for secrets
• Biometric authentication (future enhancement)
• Secure app lifecycle management

• GDPR compliant (minimal data collection)
• User data stays local by default
• Clear privacy policy
• Data export capabilities

• iOS: Privacy manifest required
• Android: Permission declarations required
• Web: Cookie consent (if applicable)

• Review Google's security guidelines
• Follow API best practices
• Monitor usage and quotas
• Implement error handling

• Verify package integrity
• Use subresource integrity (SRI) when possible
• Have fallback mechanisms

In case of a security incident:

1. Assess Impact

   • Determine scope and severity
   • Identify affected versions

2. Contain

   • Patch vulnerability
   • Prepare hotfix release

3. Communicate

   • Notify affected users
   • Publish security advisory
   • Update documentation

4. Remediate

   • Release patched version
   • Monitor deployment
   • Verify fix effectiveness

5. Post-Mortem

   • Document incident
   • Improve processes
   • Update security measures

• OWASP Top 10
• Electron Security
• React Security Best Practices
• Capacitor Security

For security concerns:

• GitHub Security Advisories
• Email: security@massivemagnetics.com

Last Updated: November 23, 2025
Version: 1.0.0