The Blue Player team and the Shapak-Apps organization take the security of our software seriously. This document describes how to report vulnerabilities, which versions we support, and the security principles built into the project.

We only support the latest released version of Blue Player. Security fixes are landed on the main branch first and shipped in the next tagged release.

If you are running an older build, please update before reporting — the issue may already be fixed.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests. Public disclosure before a fix is available puts all users at risk.

Instead, use one of the following private channels:

1. GitHub Private Vulnerability Reporting (preferred): open the Security tab of this repository and click "Report a vulnerability". This keeps the report confidential and gives you a private fork to develop a proof of concept.
2. Email: [email protected] with the subject line [SECURITY] Blue Player — <short summary>.

• A clear description of the vulnerability and its potential impact
• The affected component, version tag, or commit SHA
• Step-by-step reproduction instructions, including proof-of-concept code, logs, or screenshots where possible
• The Android version(s) and device(s) where the issue was reproduced
• Whether exploitation requires physical access, user interaction, or network position

We follow a 90-day coordinated disclosure window. We will not publish details of an unresolved vulnerability without your agreement, and we ask that you do not disclose publicly until a fix is available.

Researchers who report valid, previously unknown vulnerabilities will be credited in our release notes and in the Security acknowledgments section below, unless they prefer to remain anonymous.

• Blue Player application code (Kotlin, Jetpack Compose UI)
• The native C++ audio engine and its JNI layer
• Media3 / ExoPlayer integration as used by the app (playback session, media notification, media browsing)
• MediaStore interactions: library scanning, track deletion, queue and playlist persistence
• Network clients used for cover-art lookup (iTunes Search, Deezer, MusicBrainz / Cover Art Archive)
• Local storage of user data (settings, favorites, playlists, bookmarks)

• Vulnerabilities in the Android operating system or device firmware
• Upstream vulnerabilities in androidx.media3, ExoPlayer, Glide, Jetpack Compose, or other third-party libraries — please report those to the respective projects; we will update our dependencies promptly
• The third-party web services we query (itunes.apple.com, api.deezer.com, musicbrainz.org, coverartarchive.org)
• Attacks that require physical access to an unlocked device
• Social engineering attacks
• Findings from automated scanners without a working proof of concept
• Rate-limiting or denial-of-service concerns against third-party APIs
• Issues that only affect already-rooted or heavily modified devices

Blue Player is designed with privacy and safety in mind:

• No backend server. All user data — library, playlists, favorites, settings, playback position — is stored locally on the device.
• Minimal network usage. The only network calls are HTTPS cover-art metadata lookups. No personal data, library contents, or listening history ever leave the device.
• No analytics, no tracking, no advertising SDKs.
• Scoped Storage compliance. File access goes through MediaStore; track deletion uses the system consent dialogs required on Android 11+.
• Hardened release builds. Release artifacts are minified and resource-shrunk with R8/ProGuard and distributed only as signed builds via GitHub Releases.

We consider security research conducted in good faith on Blue Player to be authorized. If you follow this policy while researching, we will not pursue legal action against you, and we will work with you to understand and resolve any issue you find. If a third party initiates legal action against you for research performed in accordance with this policy, we will make it known that your actions were authorized.

We thank the following researchers for responsibly disclosing security issues:

This policy may be updated from time to time. Material changes will be announced in release notes. The current version always lives at the root of this repository.

• Security reports: [email protected]
• General questions: open a regular GitHub issue
• Organization: Shapak-Apps