This document describes the data sent only after the user explicitly chooses Send Report in the Open Salamander Bug Reporter. The consent text in that dialog identifies the archive, its destination, its use of HTTPS, and the View Report and Do Not Send Report alternatives. The application does not upload a report automatically.
| Item | Value |
|---|---|
| Protocol | HTTPS, using Windows WinHTTP and SChannel certificate-chain and hostname validation |
| Method and format | POST with one multipart/form-data part named taskscapefile; WinHTTP uses chunked transfer framing |
| Versioned endpoint expected by the service | https://reports.taskscape.com/api/v1/crash-reports |
| Current endpoint address configured in the client | https://reports.taskscape.com/api/v1/crash-reports |
| Legacy endpoint replaced by this change | http://reports.taskscape.com/upload.php |
The client opens the request only with WINHTTP_FLAG_SECURE on the standard
HTTPS port. It does not relax certificate or hostname checks. Redirects are
disabled, so the service cannot redirect a report to HTTP. The client honours
an explicitly configured Windows/Internet Settings proxy; HTTPS remains
end-to-end between the client and reports.taskscape.com through a standard
CONNECT-capable proxy.
The request contains these application-controlled wire fields:
| Field | Value |
|---|---|
| Request target | POST /api/v1/crash-reports to reports.taskscape.com:443 |
| User agent | Open Salamander Bug Reporter/1.0 |
| Content type | multipart/form-data; boundary=---------------------------OpenSalamanderCrashReport |
| Transfer framing | Transfer-Encoding: chunked, generated by WinHTTP; no Content-Length is calculated or sent by the application |
| Multipart part | Content-Disposition: form-data; name="taskscapefile"; filename="<archive-name>.7Z" and Content-Type: application/octet-stream |
| Part payload | The raw bytes of that one .7Z archive |
WinHTTP may add normal protocol headers required by the selected HTTP version or proxy. The uploader neither sets nor persists cookies, an authentication token, or separate telemetry identifiers.
The endpoint must return a 2xx HTTP status and the established bounded result
body <response>0</response> for a successful upload. Non-2xx responses,
certificate failures, proxy failures, malformed responses, and redirects are
reported to the user and leave the archive on disk.
The upload reads and writes fixed 64 KiB chunks, tracks the archive size with
64-bit arithmetic, and accepts at most 64 KiB of response body. It applies
15-second DNS/connect and 30-second send/receive limits. Closing the uploader
window or pressing Esc cancels the active request and retains the archive. The
client retries once only if WinHttpSendRequest fails before it has written
any multipart bytes; it never retries after a body byte has been accepted,
because a POST might then have reached the service.
The upload contains exactly one .7Z file. Its multipart filename is the
archive filename and its payload is the archive bytes. The crash reporter
creates the archive from an explicit allowlist for the selected report base name;
an unrelated file that merely shares the base-name prefix is never exported. The report may contain
the following files:
| Data | Source | When included |
|---|---|---|
Windows minidump (.DMP) |
MiniDumpWriteDump for the crashed Open Salamander process |
Created for the crash; it contains process/thread/module/exception metadata and intentionally excludes private writable memory, module data segments, and handle data. |
Crash text report (.TXT) |
The main application writes its crash/call-stack report after Salmon signals dump completion | Created for the crash; it identifies the crash and contains diagnostic text. |
Release diagnostic ring (.OPS) |
A fixed in-memory ring is rendered into the crash text report and a local .OPS sidecar |
Contains only sanitized operation transitions, wait results, retry labels, and plug-in DLL leaf names; it excludes paths, file names, and document data. View Report provides the local export without sending it. |
User report (.INF) |
The bug reporter writes Email: <optional contact email> followed by the optional “Last action” description |
Created only when the user presses Send Report. The contact email and description are optional, but both are included verbatim when supplied. |
The multipart request itself additionally exposes the archive filename, the standard HTTPS request metadata needed to deliver it, and the destination hostname. It does not add telemetry, cookies, an authentication token, or separate machine identifiers. A report base name can include the locally stored crash-reporter UID, application version, and timestamp, so that identifier is visible in the archive filename.
Reports are assembled in the crash-report directory supplied by the main
application. The View Report button opens that folder so the user can
inspect the files before choosing to send. Do Not Send Report skips network
transmission and follows the dialog's deletion flow, which removes only the selected report's
.DMP, .TXT, .INF, .OPS, and (when appropriate) .7Z artifacts. A failed or cancelled
transmission keeps the .7Z archive and shows its folder so it can be sent
through another channel or deleted by the user. Before a dump or archive is
created, the reporter enables Windows EFS on that directory; if EFS cannot be
enabled, the report operation fails rather than leaving a cleartext crash
artifact at rest. On startup, the reporter deletes only recognized crash-artifact
extensions (.DMP, .TXT, .INF, .OPS, and .7Z) older than 30 days; it
does not remove arbitrary files from the report directory.