JonKazama-Hellion
6e24885241
Removing BetterTTV took out the plugin's only outbound network call, and five documents were still describing it as present. PRIVACY.md led with "one outbound network call exists by design" -- the opposite of what shipped an hour ago, and the one claim in that file people actually check. PRIVACY.md now opens with none at all. The section that described the call is kept and marked as removed rather than deleted, so the claim can be read against what it replaced: the startup fetch meant BetterTTV saw an IP as soon as the plugin loaded, whether an emote ever appeared or not. Worth leaving visible. BetterTTV also comes out of the third-party table, which now lists only the two parties nobody using this plugin through Dalamud can avoid. SECURITY.md listed the EmoteCache HTTP client as in scope for reports. There is nothing there to report on. THIRD_PARTY_NOTICES.md named the call as current; both entries it has ever carried are now historical. README dropped the pointer to the outbound call and the switch for it, a stability bullet about a crash fix in code that no longer exists, and the line in the Chat 2 migration that moved an emote cache directory nothing reads. ROADMAP gained 2.0.1 and 2.0.2, and a section for what the 2.0.0 push left behind: 47 overlong comment blocks, channel names translated in only ten of the 25 languages, an orphaned EmoteCacheV1 directory on anyone who ran an older build, and the deprecated GlobalScaleSafe call that is the last compiler warning in the build.
46 lines
1.6 KiB
Markdown
46 lines
1.6 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you find a security issue in HellionChat, please do not open a public Gitea issue. Use one of the
|
|
private channels below so I can investigate and ship a fix before the details go public.
|
|
|
|
**Preferred:**
|
|
|
|
| Channel | Address |
|
|
| ---------- | -------------------------- |
|
|
| Email | `kontakt@hellion-media.de` |
|
|
| Discord DM | `@j.j_kazama` |
|
|
|
|
For urgent disclosures (active exploitation, user-data exposure) email is the fastest path.
|
|
|
|
I respond on weekdays during European business hours.
|
|
|
|
## Scope
|
|
|
|
### In scope
|
|
|
|
- Code paths that touch user-controlled input (chat messages, plugin config, file paths the user can
|
|
influence)
|
|
- The privacy filter in `MessageStore.cs` and the export pipeline
|
|
- The configuration migration logic
|
|
- The Auto-Tell-Tabs spawn logic and history preload
|
|
|
|
### Out of scope
|
|
|
|
- Issues in upstream Chat 2 that HellionChat has not modified — report those at
|
|
<https://github.com/Infiziert90/ChatTwo/issues>
|
|
- Issues in Dalamud itself — those go to <https://github.com/goatcorp/Dalamud>
|
|
- Issues in the FFXIV game client
|
|
- Anything that requires the user to install a malicious plugin first
|
|
|
|
## Disclosure Window
|
|
|
|
I aim to ship a fix within 14 days for high-severity issues and within 30 days for everything else.
|
|
If a fix needs more time I will say so in the private thread.
|
|
|
|
## Credits
|
|
|
|
Everyone who reports a real issue gets listed in the changelog of the release that fixes it, unless
|
|
they prefer to stay anonymous. No bug bounty, nothing financial — this is a hobby plugin.
|