James Maes
514f8eb15b
Sweep every README/doc for accuracy and remove fabricated or stale content: - README/CLAUDE: add the live roadmap-page link and a rule to keep the rendered page in sync with docs/ROADMAP.md; fix the stale cov alias and the already-moved-shells note. - .github/CONTRIBUTING+SECURITY: drop the fabricated nuncio.mx site link and the aspirational release/security claims; state honest pre-alpha status. - docs/RUNNING, DEVELOPING, ARCHITECTURE, BACKLOG, Home, NSQL spec, corruption notes, proto/README: correct crate count/list, service list, CLI flags, phase status, and remove claims of unshipped/removed things (IPC-as-current, hardcoded-keys, unwired engines); mark superseded api-surface-draft historical. - Remove the fabricated benchmark baked into nsql_pipeline.svg and delete the orphaned ipc_sequence.svg (depicted the removed IPC with a fake timing).
2.5 KiB
2.5 KiB
Security Policy
Nuncio handles sensitive mail, calendar, and contact data plus authentication credentials, so security is a first-class concern. Status: pre-alpha. Several hardening items — at-rest encryption correctness, key zeroization, a fail-closed signature-verifying updater, and transport/egress hardening — are tracked under roadmap milestone M6 and are not all complete. Do not use Nuncio with real accounts or sensitive data yet.
Supported Versions
| Version | Supported |
|---|---|
| all pre-1.0 | Not supported — non-functional pre-alpha, under active reconstruction |
Reporting a Vulnerability
Do NOT report security vulnerabilities via public GitHub Issues.
If you discover a security vulnerability in Nuncio, please report it privately:
- Email: Security reports should be emailed to
security@kof22.com(orjames@kof22.com). - Response Time: We will acknowledge receipt of your report within 48 hours and provide a detailed assessment and remediation timeline within 7 business days.
Security Practices in Nuncio
- Credential Vault Integration: Nuncio never stores plain-text passwords or refresh tokens in configuration files or unencrypted SQLite tables. All authentication credentials are directed to OS native vaults (
keyringcrate) such as macOS Keychain, Windows Credential Manager, and Linux Secret Service (D-Bus). - Untrusted HTML Sandboxing: In the desktop GUI shell (
nuncio-gui), untrusted HTML emails are rendered inside isolated<iframe sandbox>tags with JavaScript execution disabled, custom URI protocols (nuncio-mail://) proxying attachments, and remote tracking pixel loading blocked by default. - Data-at-Rest Encryption: Offline attachment blobs and local caches are encrypted at rest using
age(X25519 / ChaCha20-Poly1305 streaming cipher) and AES-256-GCM column encryption (PayloadCipher). - Daemon Security Enclave: Plaintext secrets and private keys reside strictly inside
nunciodheap memory protected byZeroizeOnDropmemory wrappers. Local IPC streams validate socket peer identity (SO_PEERCREDUID checks on POSIX, Windows Named Pipe SID DACLs, and constant-time 256-bit bearer token verification). - MCP Capability Safety & HITL Prompts: Model Context Protocol (
nuncio-mcp) tools operate underAgent-RestrictedRBAC policies. Destructive actions (such as sending emails) trigger Human-in-the-Loop (HITL) prompt interception in presentation UIs before execution.