Skip to content

Security: yuyisheshen/ThreeFingerDrag-Windows

Security

SECURITY.md

安全策略 / Security Policy

简体中文 | English


简体中文

报告安全漏洞

请勿在公开 Issue 中发布敏感漏洞细节。

如果仓库已启用 GitHub 私密漏洞报告,请优先使用该功能。报告中请包含受影响版本、复现步骤和预期影响。

校验可执行文件

Release 文件目前尚未进行代码签名。每个 Release 都包含 SHA256SUMS.txt,请在运行安装器前进行校验:

Get-FileHash -Algorithm SHA256 .\ThreeFingerDragInstaller.exe

将结果与同一 GitHub Release 中的校验值进行比较。

数据处理

ThreeFingerDrag 只在本地处理 HID 触摸报告,不会上传触摸数据。诊断日志仅保存在所选安装目录中。


English

Reporting a vulnerability

Do not publish sensitive vulnerability details in a public issue.

Use GitHub private vulnerability reporting when it is enabled for this repository. Include the affected version, reproduction steps, and expected impact.

Verifying executables

Release assets are currently unsigned. Every Release includes SHA256SUMS.txt. Verify the installer before running it:

Get-FileHash -Algorithm SHA256 .\ThreeFingerDragInstaller.exe

Compare the result with the checksum attached to the same GitHub Release.

Data handling

ThreeFingerDrag processes HID touch reports locally and does not upload touch data. Diagnostic logs remain in the selected installation directory.

There aren't any published security advisories