WejdanBa-CS · WejdanBa-CS · Aug 9, 2026 · Aug 9, 2026 · Aug 9, 2026 · Aug 9, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,37 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+          cache: true
+      - run: flutter pub get
+      - run: flutter test
+
+  secrets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Scan tracked files for leaked secrets
+        run: |
+          set -e
+          patterns='eyJhbGci[A-Za-z0-9_-]{10,}|sk-proj-[A-Za-z0-9]{10,}|GOCSPX-[A-Za-z0-9_-]{10,}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|[0-9]{12,}-[a-z0-9]+\.apps\.googleusercontent\.com'
+          if git grep -E "$patterns" -- ':!google_oauth.example.env' ':!*.md' ':!lib/screens/account_screen.dart' ':!.github/workflows/ci.yml'; then
+            echo 'Possible secret found in tracked files — see matches above.'
+            exit 1
+          fi
+          echo 'No secret patterns in tracked source files.'
diff --git a/.gitignore b/.gitignore
@@ -43,3 +43,12 @@ app.*.map.json
 /android/app/debug
 /android/app/profile
 /android/app/release
+
+# Local Google OAuth secrets (use google_oauth.example.env as a template)
+google_oauth.env
+
+# Android release signing (never commit)
+android/key.properties
+android/*.jks
+android/*.keystore
+**/upload-keystore.jks
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,19 @@
+Copyright (c) 2026 Wejdan Al Amri. All rights reserved.
+
+This repository contains the Signata digital watermarking application source code.
+
+Permission is granted to view and fork this repository for personal learning,
+non-commercial evaluation, and security research.
+
+Without prior written permission from the copyright holder, you may NOT:
+
+- Use this software or its design to operate a competing product or service
+- Redistribute, sublicense, or sell copies of this software
+- Remove copyright or attribution notices
+- Use the "Signata" name, logo, or branding in a way that implies endorsement
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. THE AUTHOR
+SHALL NOT BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM
+USE OF THIS SOFTWARE.
+
+For licensing inquiries: FocusMindDev@gmail.com
diff --git a/PRIVACY.md b/PRIVACY.md
@@ -0,0 +1,57 @@
+# Privacy Policy for Signata
+
+**Last Updated:** August 10, 2026
+
+At Signata, we are fully committed to protecting the privacy of our users and securing digital content with the highest security standards. This Privacy Policy explains how we collect, use, process, and protect your personal data, media files, and the links you trace through our platform.
+
+## 1. Data We Collect and Process
+
+Given Signata's nature as a digital watermarking and ownership verification platform, we handle specific categories of data:
+
+- **Basic Account Data:** Upon registration, we collect the necessary information to create and manage your account (e.g., name, email address, and authentication data).
+- **Media Files:** This includes images (PNG, JPG), audio (WAV), video clips (MP4/MOV), and documents (PDF) that you protect or verify using the app.
+- **Metadata & Encrypted Fingerprints:** We process and generate structural identifiers (such as SHA-256) and hidden encrypted fingerprints to prove content ownership.
+- **Trace Data & Public URLs:** The public links you input into the "Trace" tool to scan for your content on platforms like Instagram, TikTok, and X.
+
+## 2. On-Device Verification & Processing
+
+At Signata, the security and privacy of your content are our top priorities:
+
+- **Media Protection:** Embedding watermarks, audio fingerprints, and structural identifiers for videos and documents runs locally on your device.
+- By default Signata does not upload your original media or claim keys to Signata servers. History, Trace radar, and published claims stay in on-device storage scoped to your account.
+- If you later configure an optional self-hosted claim registry, only fingerprint metadata you choose to publish may leave the device — never your original files.
+
+## 3. How We Use Your Data
+
+The data we collect is strictly used for the following purposes:
+
+- To enable you to embed hidden ownership fingerprints in media without altering its visual or auditory quality.
+- To operate the Radar and Trace services, scanning public links and matching them against your registered fingerprints to detect unauthorized use.
+- To improve our hidden fingerprint algorithms and their robustness against common modifications (such as compression, cropping, and color shifts).
+- To provide technical support and manage your account.
+
+## 4. Third-Party Services and External Links
+
+- **Trace Tool:** This tool interacts with the public interfaces of platforms (like Instagram, TikTok, and X) to scan the links you provide. We do not control the privacy practices of these platforms, and your interaction with them is governed by their respective privacy policies.
+- We will never share your Trace logs, search history, or encrypted fingerprints with any third parties for marketing or advertising purposes.
+
+## 5. Data Security
+
+We implement industry-standard security protocols and advanced encryption (including SHA-256 hashing algorithms) to protect your data from unauthorized access, alteration, or disclosure. The binding of encrypted structural identifiers ensures that your proof of ownership remains secure and tamper-proof.
+
+## 6. User Rights (Access and Deletion)
+
+In accordance with applicable data protection laws, you have the right to:
+
+- **Access:** View your ownership records (History) and actively tracked links (Watching) directly in the app.
+- **Deletion:** Use Account → Delete account to erase your local Signata account record, claim key, history, Trace data, and usage flags on this device. This does not remove watermarks already embedded in exported files. Email FocusMindDev@gmail.com for privacy requests beyond what the app can erase locally.
+
+## 7. Governing Law and Policy Updates
+
+This Privacy Policy is governed by and construed in accordance with the applicable laws of the Kingdom of Saudi Arabia, primarily the Personal Data Protection Law (PDPL). We may update this policy periodically, and we will notify you of any material changes via the app or email.
+
+## 8. Contact Us
+
+For any legal or technical inquiries regarding your privacy and data management, please contact us at:
+
+**Support Email:** FocusMindDev@gmail.com
diff --git a/README.md b/README.md
@@ -1,38 +1,103 @@
-# Signata (Flutter)
+# Signata
 
-Invisible ownership. Verifiable authenticity.
+**Invisible ownership. Verifiable authenticity.**
 
-Native Flutter app for digital watermarking — images, audio, video, and PDFs — processing entirely on-device.
+Native Flutter app for digital watermarking — images, audio, video, and PDFs — with processing entirely on-device.
 
-## What's included
+**Latest release:** [v1.2.4](https://github.com/WejdanBa-CS/Signata/releases/tag/v1.2.4)
 
-- **Home** — full landing story (features, how it works, architecture, roadmap)
-- **Tools hub** — Image, Audio, Video, and PDF protect/verify flows
-- **Auth** — email accounts + Google Sign-In gate
-- **History** — local on-device record of every embed/verify run
-- Sealed JSON verification reports (shareable)
+## Screenshots
 
-## Run
+<p align="center">
+  <img src="docs/screenshots/01-home.png" alt="Signata home" width="180" />
+  <img src="docs/screenshots/02-capabilities-image.png" alt="Image watermarking" width="180" />
+  <img src="docs/screenshots/03-capabilities-audio-video.png" alt="Audio and video" width="180" />
+  <img src="docs/screenshots/04-tools.png" alt="Tools hub" width="180" />
+  <img src="docs/screenshots/05-trace.png" alt="Trace online" width="180" />
+</p>
+
+| Screen | File |
+|--------|------|
+| Home | [`docs/screenshots/01-home.png`](docs/screenshots/01-home.png) |
+| Image watermarking | [`docs/screenshots/02-capabilities-image.png`](docs/screenshots/02-capabilities-image.png) |
+| Audio & video | [`docs/screenshots/03-capabilities-audio-video.png`](docs/screenshots/03-capabilities-audio-video.png) |
+| Tools | [`docs/screenshots/04-tools.png`](docs/screenshots/04-tools.png) |
+| Trace | [`docs/screenshots/05-trace.png`](docs/screenshots/05-trace.png) |
+
+## Features
+
+- **Protect** — embed signed ownership fingerprints in images, audio, video (MP4/MOV), and PDFs
+- **Verify** — read fingerprints back from shared files and confirm they match your claim key
+- **Trace online** — scan public media URLs, watchlist re-scans, publish claims for catalog matching
+- **Sealed reports** — shareable JSON verification reports with tamper detection
+- **Auth** — email accounts + Google Sign-In; accounts and claim keys stay on-device
+- **History** — local record of every embed/verify run
+- **Privacy-first** — no Signata cloud database required; optional self-hosted claim registry
+
+## Stack
+
+| Layer | Tech |
+|-------|------|
+| App | Flutter 3.x, Dart 3.12+ |
+| Crypto | PBKDF2, Ed25519-style claim signing, SHA-256 structural IDs |
+| Media | On-device codecs for PNG/JPG, WAV, MP4/MOV, PDF |
+| Auth | Google Sign-In (optional), local email accounts |
+| Release | Android App Bundle (Play Console) |
+
+## Quick start
 
 ```sh
+git clone https://github.com/WejdanBa-CS/Signata.git
+cd Signata
 flutter pub get
 flutter run
 ```
 
+Optional remote claim registry (so other devices can look up fingerprints):
+
+```sh
+flutter run --dart-define=SIGNATA_REGISTRY_URL=https://your-registry.example
+```
+
+See [`tool/registry_server.example.md`](tool/registry_server.example.md) for the expected HTTP API. Without it, tracing still works by reading fingerprints from downloaded files and matching your on-device published claims.
+
+## Google Sign-In (optional)
+
+Copy `google_oauth.example.env` → `google_oauth.env` and set your Web client ID:
+
+```env
+GOOGLE_SERVER_CLIENT_ID=YOUR_WEB_CLIENT_ID.apps.googleusercontent.com
+```
+
+Then run:
+
+```sh
+flutter run --dart-define-from-file=google_oauth.env
+```
+
+Full Play release checklist: [`docs/RELEASE_PLAY.md`](docs/RELEASE_PLAY.md)
+
+**Never commit** `google_oauth.env`, `android/key.properties`, or keystore files.
+
 ## Test
 
 ```sh
 flutter test
 flutter analyze
 ```
 
-## Build Android APK
+67 unit/integration tests cover auth, TOTP, local data, watermark round-trips, tracing, and sealed reports.
+
+## Build Android
 
 ```sh
 flutter build apk --release
+# or for Play Store:
+.\tool\build_release.ps1
 ```
 
-The APK lands at `build/app/outputs/flutter-apk/app-release.apk`.
+APK: `build/app/outputs/flutter-apk/app-release.apk`  
+AAB: `build/app/outputs/bundle/release/app-release.aab`
 
 > On Windows, Flutter plugin builds need **Developer Mode** enabled (`start ms-settings:developers`) so symlinks work. If a Gradle build fails with a lock error, stop other Gradle/Android Studio processes and retry.
 
@@ -46,5 +111,26 @@ lib/
   theme.dart
   main.dart
 assets/
+docs/             # Play release, privacy HTML, delete-account page
+docs/screenshots/ # App store / README phone screenshots
 website-source/   # original React site (reference)
 ```
+
+## Privacy
+
+Full policy: [`PRIVACY.md`](PRIVACY.md) · hosted copy in [`docs/privacy.html`](docs/privacy.html)  
+Terms: [`docs/terms.html`](docs/terms.html)
+
+## License & copyright
+
+Copyright © 2026 Wejdan Al Amri. All rights reserved.
+
+Source is published for transparency and portfolio use. See [`LICENSE`](LICENSE) — you may not copy, redistribute, or run a competing commercial service from this code without permission.
+
+## Security
+
+Report issues responsibly — see [`SECURITY.md`](SECURITY.md).
+
+## Contact
+
+Questions: [FocusMindDev@gmail.com](mailto:FocusMindDev@gmail.com)
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,71 @@
+# Security
+
+We take security seriously for Signata, especially around claim keys, on-device auth, and trace tooling.
+
+## Reporting a vulnerability
+
+**Please do not** open public GitHub issues for security bugs.
+
+Email **FocusMindDev@gmail.com** with:
+
+- Description of the issue
+- Steps to reproduce
+- Impact (what an attacker could access or do)
+- Your GitHub username (optional, for credit)
+
+We aim to respond within a few business days.
+
+## Scope
+
+In scope:
+
+- Authentication bypass, weak local crypto, or recovery-kit tampering
+- Watermark / fingerprint forgery or verification bypass
+- Unsafe URL handling in Trace (open redirects, unexpected fetches)
+- Data leaks from optional registry integration
+- Android signing or OAuth misconfiguration documented in this repo
+
+Out of scope:
+
+- Social engineering, physical device access
+- Denial of service without a practical exploit path
+- Issues in third-party services (Google Sign-In, Play Console)
+- Attacks that require the victim to import a malicious recovery kit they did not create
+
+## Safe harbor
+
+Good-faith research that avoids privacy violations and service disruption is appreciated.
+
+## Secrets checklist
+
+**Never commit:**
+
+- `google_oauth.env` (use `google_oauth.example.env` only)
+- `android/key.properties`, `*.jks`, `*.keystore`
+- Real Google OAuth client IDs in source (build with `--dart-define-from-file` or paste at runtime in Account)
+
+Android SHA-1 fingerprints in docs are **not secrets** (they appear in signed APKs) but keep upload keystore passwords local only.
+
+CI runs a basic secret pattern scan on every push.
+
+## OWASP-aligned controls (Cheat Sheet Series)
+
+| Control | Status | Notes |
+|--------|--------|-------|
+| **Authentication** | Strong | PBKDF2-SHA256, TOTP 2FA, lockout, secure session storage |
+| **Cryptography** | Strong | Claim keys and watermarks stay on-device; recovery kit integrity checks |
+| **Input validation** | Hardened | Trace URLs validated in `lib/core/safe_url.dart` — http(s) only, no private/metadata hosts, no embedded credentials |
+| **SSRF (Trace / registry)** | Hardened | Block localhost, RFC1918, link-local, and CGNAT ranges before any outbound fetch; registry base must be **https** |
+| **Rate limiting** | Hardened | Trace scans capped at 40/hour per device session (`TraceRateLimiter`) |
+| **Logging / errors** | Good | Neutral auth errors; remote registry failures logged without leaking secrets |
+| **Secrets** | Good | OAuth and keystore material via env / dart-define only; CI secret scan |
+| **Transport** | Good | Registry requires HTTPS; Trace allows public http(s) media URLs only after host validation |
+
+### Trace URL policy
+
+- Allowed: public `http://` and `https://` media or social page URLs
+- Blocked: `file://`, `ftp://`, `localhost`, `.local`, `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `100.64.0.0/10`, URLs with userinfo
+
+### Optional registry
+
+Set `SIGNATA_REGISTRY_URL` to a **public https** endpoint. Invalid or private URLs are ignored at configure time. Claim references in remote lookups are length-capped and URL-encoded.