diff options
| -rw-r--r-- | CHANGELOG.md | 6 | ||||
| -rw-r--r-- | SECURITY.md | 23 | ||||
| -rw-r--r-- | app/src/main/java/app/passwordstore/ui/settings/AboutScreen.kt | 3 | ||||
| -rw-r--r-- | app/src/main/res/values-it/strings.xml | 1 | ||||
| -rw-r--r-- | app/src/main/res/values/strings.xml | 1 |
5 files changed, 34 insertions, 0 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 92e01107..6c9c6fee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ All notable changes to this project will be documented in this file. +## [Unreleased] + +### Added + +- About: "Report a security issue" links to the security policy, with the maintainer's OpenPGP key for private reports + ## [0.3.4] - 2026-11-09 ### Added diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..d8c1f25c --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,23 @@ +# Security policy + +## Reporting a vulnerability + +Please report security issues privately, not on the public issue tracker. + +Email <danix@danix.xyz>, encrypted to the maintainer's OpenPGP key if you can: + + 110E 1B11 1BA2 C3C7 CCD1 27B8 F96B 36CA CC44 17AE + +Fetch it with either of these, and check that the fingerprint matches: + + gpg --locate-keys danix@danix.xyz + gpg --keyserver hkps://keys.openpgp.org --recv-keys 110E1B111BA2C3C7CCD127B8F96B36CACC4417AE + +Include the HardenedPass version (Settings, About), the Android version, and the +steps to reproduce. + +## Supported versions + +Only the latest release gets fixes. No app store delivers HardenedPass updates: +install the newest APK from +[GitHub Releases](https://github.com/danixland/HardenedPass/releases/latest). diff --git a/app/src/main/java/app/passwordstore/ui/settings/AboutScreen.kt b/app/src/main/java/app/passwordstore/ui/settings/AboutScreen.kt index 4a366390..6c20d3af 100644 --- a/app/src/main/java/app/passwordstore/ui/settings/AboutScreen.kt +++ b/app/src/main/java/app/passwordstore/ui/settings/AboutScreen.kt @@ -152,6 +152,9 @@ private fun AboutScreen( LinkRow(stringResource(R.string.about_changelog)) { onOpen(changelog) } LinkRow(stringResource(R.string.about_source)) { onOpen(REPOSITORY) } LinkRow(stringResource(R.string.about_issues)) { onOpen("$REPOSITORY/issues") } + LinkRow(stringResource(R.string.about_security)) { + onOpen("$REPOSITORY/blob/master/SECURITY.md") + } // White in both themes: the logo's dark outline disappears on a dark background, and Ko-fi // asks that the logo itself stays as it is. Button( diff --git a/app/src/main/res/values-it/strings.xml b/app/src/main/res/values-it/strings.xml index fed8adec..18065976 100644 --- a/app/src/main/res/values-it/strings.xml +++ b/app/src/main/res/values-it/strings.xml @@ -393,6 +393,7 @@ <string name="about_changelog">Novità</string> <string name="about_source">Codice sorgente</string> <string name="about_issues">Segnala un problema</string> + <string name="about_security">Segnala un problema di sicurezza</string> <string name="about_support">Sostieni su Ko-fi</string> <string name="about_privacy_title">Privacy</string> <string name="about_privacy">Nessuna telemetria, nessuna analisi, nessun servizio Google. HardenedPass si collega solo al tuo server git, tramite il tuo proxy se ne imposti uno.</string> diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml index a415e95f..ec2396be 100644 --- a/app/src/main/res/values/strings.xml +++ b/app/src/main/res/values/strings.xml @@ -427,6 +427,7 @@ <string name="about_changelog">What\'s new</string> <string name="about_source">Source code</string> <string name="about_issues">Report a problem</string> + <string name="about_security">Report a security issue</string> <string name="about_support">Support on Ko-fi</string> <string name="about_privacy_title">Privacy</string> <string name="about_privacy">No telemetry, no analytics, no Google services. HardenedPass connects only to your git server, through your proxy if you set one.</string> |