900Project is an offline-first desktop application. Security reports should minimize public detail until a maintainer can assess impact and coordinate a fix.

Pre-release branches and local development builds are supported only when the report includes enough public-safe evidence to reproduce the issue from the repository.

Prefer GitHub Security Advisories for private vulnerability reports when they are enabled on the repository.

If private advisories are unavailable, open a minimal public issue that says you need to report a security issue. Do not include exploit details, secrets, private workspace data, private .900proj bundles, attachment blobs, or local absolute paths in that public issue.

Include public-safe context when possible:

• affected version or commit
• platform
• impacted area such as workspace encryption, import/export, updater, release artifacts, support bundles, or Tauri capabilities
• whether the issue is reproducible from public fixtures or generated repo evidence

In scope:

• local workspace confidentiality or integrity defects
• import/export or .900proj handling that can corrupt or expose data
• updater, release, signing, or artifact-verification weaknesses
• Tauri capability or plugin-surface regressions
• support-bundle or issue-kit privacy leaks

The in-app workspace lock is a convenience gate, not the primary at-rest protection. The lock's PIN is never persisted in plaintext: Rust stores only a salted, iterated SHA-256 digest under app_lock.pin_hash, and verification uses a constant-time comparison. SQLCipher workspace encryption remains the primary at-rest confidentiality control. Treat the app lock as defense in depth on top of an encrypted workspace, not as a replacement for it.

Out of scope:

• social engineering
• denial-of-service against GitHub or third-party services
• reports requiring private user data without a public-safe reproduction path
• broad scanning or probing outside this repository and its published artifacts

Maintainers should acknowledge security reports, reproduce from public-safe evidence where possible, keep fixes scoped, and add regression coverage when practical. Public disclosure should wait until maintainers have a fix or a documented mitigation path.