Kenafold is a desktop file manager with a large attack surface — it reads every file you point it at, runs user-defined shell commands, and shells out to git. We take security reports seriously and aim to triage new issues within 72 hours.

Do not file a public GitHub issue for security bugs.

Email the maintainers at security@luqueee.dev (PGP key on request) with:

1. A short description of the vulnerability.
2. Steps to reproduce, ideally a proof-of-concept.
3. The expected vs. actual behaviour.
4. The version of Kenafold you reproduced on (Help → About shows the commit SHA).

We will:

• Acknowledge within 72 hours.
• Triage and assign a CVSS-like severity within 5 business days.
• Ship a fix in the next patch release for high / critical issues, or in the next minor release for medium / low. We may fast-track a patch release for actively-exploited issues.

We follow coordinated disclosure: please give us a reasonable window (typically 90 days) before going public.

Kenafold is a single-user desktop app with no network server. The realistic threats are:

• Local file disclosure — a malicious file in the user's home directory could be exfiltrated by a malicious context-menu script. Mitigation: the fs.gateway.ts invokes only the Rust commands defined in apps/app/src-tauri/src/. The app.manage(state) pattern ensures no untrusted code can call into the backend.
• Shell command injection — the user-defined shell command feature (code {path}) substitutes tokens as argv elements, not as a shell string. See apps/app/src-tauri/src/commands.rs. The substitution never goes through /bin/sh; the spawned process receives the substituted path as a separate argv element.
• Drag-and-drop from another app — the Rust side surfaces native drops (WindowEvent::DragDrop) to the renderer as a plain path list. The renderer (resolveDropTarget.ts) decides copy vs. move based on the drop target. Files are never auto-opened on drop.
• Git status shell-out — git_status.rs shells out to git status --porcelain --untracked-files=all --no-renames. Because the user pointed Kenafold at a directory tree, executing git there is a known, scoped operation. (Sprint 8 will replace this with the pure-Rust gix crate to remove the system dependency.)
• Tauri asset protocol — the assetProtocol.scope in tauri.conf.json whitelists $HOME, XDG dirs, and removable media mounts. Files outside those paths cannot be served to the renderer via convertFileSrc.

For non-security bugs, please use the GitHub issue tracker. Pick the right template (bug, feature, question) and include the output of Help → About so we can reproduce on the same build.

(No reports yet — be the first.)