Varun S G
fada5f2e9d
Document that server_py binds to loopback and serves unauthenticated, that loopback binding is the trust boundary, and how to report vulnerabilities privately via GitHub Security Advisories. Only the latest release is supported.
1.3 KiB
Security Policy
Scope
text-to-cad is a local-filesystem development tool. The CAD Viewer backend
(viewer/server_py) binds to loopback (127.0.0.1) by default and serves
unauthenticated. Any local process can read files under the directory the
viewer opens, trigger STEP builds/exports, and activate directories.
This is a single-user, local-filesystem viewer: loopback binding is the
trust boundary. Do NOT bind a non-loopback --host or expose this server
beyond localhost without adding authentication.
Reporting a Vulnerability
If you discover a security vulnerability, report it privately:
- Use the repository's Security tab → Report a vulnerability (GitHub Security Advisories).
- Do NOT open a public issue or pull request for a security vulnerability.
- Include a description, reproduction steps, and potential impact.
We aim to acknowledge reports within 48 hours and provide a fix timeline within 7 days. We ask that you give us time to address the issue before disclosing it publicly.
Supported Versions
Only the latest release is supported. No older versions receive security fixes; update to the newest tagged release to stay covered.
| Version | Supported |
|---|---|
| latest | Yes |
| older | No |