25. Security and Privacy

Every opened source is hostile input. The trust boundary begins at native acquisition and remains in force through detection, parsing, generated markup, metadata, navigation, saving, caching, logs, and packaging.

The Tauri capability set is deny-by-default and scoped by window and command. The application exposes source-handle operations, not generic filesystem or shell plugins. Capability files MUST avoid overlapping grants that silently merge permissions. Development-only capabilities are absent from release bundles.

The release content-security policy uses default-src 'self', denies network connections, objects, arbitrary frames, form submissions, and base changes, and permits only bundled scripts/styles plus scoped blob/data or application-asset sources required by reviewed renderers. The sole framed exception is a bundled, sandboxed Mermaid render context with scripts but no same-origin authority, navigation, opener, forms, downloads, storage, network, or Tauri bridge; its typed message contract contains bounded source and render results only. Inline script and eval are prohibited. Remote images, fonts, styles, workers, and media are prohibited.

Generated Markdown, DOCX, ODT, and Mermaid output is sanitized after the final unsafe transformation. Mermaid's generated SVG passes an application-owned element, attribute, namespace, CSS, URL, and output-size allowlist before insertion; standalone SVG documents remain rasterized or represented through a safe tree and are never inserted as source DOM. PDF JavaScript and office macros never execute. Archive paths are normalized and traversal is rejected. External references are reported and not fetched.

Renderer limits cover source bytes, probe bytes, decoded pixels, pages, canvases, archive entries, expanded bytes, compression ratio, relationship depth, CPU time, memory, and concurrent workers. Timeouts and cancellations produce explicit results. A parser panic or worker termination cannot crash the application host or corrupt a source.

Temporary files and recovery records use application-private directories and owner-only permissions where supported. Sensitive metadata and full locators are redacted from logs. Diagnostic bundles require explicit user creation and preview. No telemetry, crash upload, analytics, or background network report is enabled.

Dependency security uses locked inputs, automated vulnerability and license checks, secret scanning, SBOM generation, provenance attestations, and prompt review of parser advisories. Security reports use the repository security policy and private disclosure channel established by the repository-foundation slice.