Security policy

This is the vulnerability disclosure policy for Superset Files, a signed, notarized macOS desktop app distributed by Elena Maher ("the Licensor"). If you believe you have found a security vulnerability in Superset Files, we want to hear from you, and we will work with you in good faith to resolve it.

Supported versions

Security fixes are only issued for the current signed release line — the latest published version of Superset Files. We intend to deliver fixes through the in-app update channel, and keeping your app updated is the fastest way to stay protected; where that channel is unavailable to you, we will publish the updated signed build for download. This is a best-effort statement, not a guarantee of delivery through any particular mechanism.

We do not backport fixes to earlier versions. There is no separate long-term support line.

Scope

In scope:

• The packaged macOS application (the signed, notarized .app we distribute).
• The auto-update mechanism and the release feed the app reads to check for and download updates.

Out of scope:

• The contents of your own files or folders. Superset Files is a local folder viewer/editor; all file access is user-chosen and folder-scoped. What you choose to open and edit is your data, not a vulnerability in the app.
• Third-party content and CDNs you opt into. Remote images referenced by your own Markdown, and the curated CDN allowlist that only applies to an HTML file you have explicitly trusted per-file, are user-content decisions. Issues in third-party servers, CDNs, or documents you load are not in scope, though we do want to hear if the app's isolation of that content can be bypassed.
• Social-engineering, physical access, and denial-of-service against your own machine. Findings that require an already-compromised host, a malicious local admin, or tricking a user into disabling the app's protections are generally out of scope.
• Third-party services used at purchase or activation time (for example, the merchant of record's checkout and license service). Report those to the relevant provider; we will help coordinate where the issue touches Superset Files.

If you are unsure whether something is in scope, report it — we would rather review a borderline case than miss a real issue.

How to report

Please report privately. Do not open a public GitHub issue for security matters, and do not disclose the problem publicly until we have had a chance to respond and remediate.

Email: security@supersetfiles.com

We currently accept reports in plain email. If you would prefer to send an encrypted report, contact us at the address above and we will arrange a PGP key for the exchange.

What to include

A good report helps us reproduce and fix the issue quickly. Where you can, please include:

• A clear description of the vulnerability and the impact you believe it has.
• The version of Superset Files affected and your macOS version.
• Step-by-step reproduction instructions, and a minimal proof of concept if you have one.
• Any relevant logs, screenshots, or sample files needed to reproduce (please avoid sending sensitive or personal data).
• How you would suggest we fix or mitigate it, if you have a view.

What to expect

• Acknowledgement: we aim to acknowledge your report on a best-effort basis within 5 business days.
• Assessment: we will investigate, confirm whether we can reproduce the issue, and keep you informed of our findings.
• Remediation: where a fix is warranted, we will address it in a future signed release, which we intend to deliver through the in-app update channel where available. We do not commit to a fixed remediation timeline; complexity and severity vary, and we will be honest with you about our progress.
• Credit: with your permission, we are happy to credit you once a fix has shipped.

Coordinated disclosure

We ask that you give us a reasonable opportunity to investigate and remediate a reported issue before disclosing it publicly, and that you coordinate the timing of any public disclosure with us. We will not take legal action against researchers who follow this policy in good faith (see safe harbor below). We aim to be responsive and to keep you updated so that coordinated disclosure works for both sides.

Safe harbor

We consider security research and vulnerability disclosure conducted in good faith under this policy to be authorized, and we will not pursue or support legal action against you for that research, provided you:

• Make a good-faith effort to avoid privacy violations, data destruction, and any interruption or degradation of services or other users' systems.
• Only interact with accounts, data, and systems you own or are explicitly authorized to test — do not access, modify, or exfiltrate anyone else's data.
• Report the issue to us promptly and privately, and give us reasonable time to respond before any public disclosure.
• Do not exploit the issue beyond the minimum necessary to demonstrate it, and do not use it to pivot to other systems.

This safe harbor covers only conduct that is consistent with this policy and lawful. It does not authorize you to violate the app's license terms, and it does not waive any rights of third parties. If in doubt about whether an action is authorized, ask us first at security@supersetfiles.com.

Our security posture

Superset Files is built to run a hardened Electron model and has been reviewed for security more than once:

• Two adversarial security reviews have been completed against the app — conducted by the developer, not a third-party firm.
• Hardened renderer: context isolation is on, Node integration is off, the renderer is sandboxed, and a strict Content Security Policy is enforced in production.
• Local by design: all file access is local and folder-scoped to folders you choose. The app does not phone home except to (a) check the update feed for new releases, (b) send opt-in, redacted crash reports if you have turned them on, and (c) validate your license at purchase and activation time. There is no telemetry enabled by default.
• Untrusted HTML is isolated: HTML you open renders in an isolated context with scripting and network access gated behind an explicit, per-file trust gesture, and exfiltration paths kept sealed by default.

None of this means the app is free of vulnerabilities — no software is — which is exactly why this policy exists. Thank you for helping keep Superset Files and its users safe.