Please do not report security vulnerabilities through public GitHub issues.
To report a vulnerability:
- GitHub Security Advisory: Use the "Report a vulnerability" button under the Security tab of the repository on GitHub.
- Private Email: Alternatively, contact the maintainer privately with:
- A description of the issue
- Steps to reproduce
- Potential impact
- Any proposed mitigations
Security reports will be acknowledged promptly.
Security-sensitive areas include:
- Authentication and authorization
- Credential handling
- Rclone RC integration
- Dashboard APIs
- File operations
- Synchronization workflows
- Configuration management
- Session management
Please report issues involving:
- Credential disclosure
- Authentication bypass
- Authorization bypass
- Directory traversal
- Arbitrary file access
- Remote code execution
- Unsafe synchronization actions
- Exposure of secrets in logs or telemetry
Please provide reasonable time for investigation and remediation before publicly disclosing any security vulnerability.
The goal is to protect users while addressing issues responsibly.
Bisync Hub follows several core security principles:
- Local-first operation
- Principle of least privilege
- Credential redaction by default
- Explicit user actions for destructive operations
- Review before synchronization changes
- No intentional collection of user data
Users remain responsible for securing their own systems, accounts, and Rclone configurations.
Bisync Hub integrates with third-party software and libraries that are distributed under their own licenses.
Security reports relating to third-party dependencies may be redirected to the appropriate upstream project when necessary.
See:
- NOTICE
- go.mod
- Dependency license documentation