| 1 | # Security Policy |
| 2 | |
| 3 | ## Supported scope |
| 4 | |
| 5 | This repository is an open-source iOS application project. |
| 6 | |
| 7 | Security-sensitive areas include: |
| 8 | |
| 9 | - on-device model cache handling |
| 10 | - app sandbox / App Group configuration |
| 11 | - entitlements and signing setup |
| 12 | - accidental token or credential commits |
| 13 | - third-party dependency changes |
| 14 | |
| 15 | ## Reporting a vulnerability |
| 16 | |
| 17 | If you believe you found a security issue: |
| 18 | |
| 19 | 1. avoid posting exploit details in a public issue immediately |
| 20 | 2. provide a minimal reproduction and affected files |
| 21 | 3. give maintainers reasonable time to triage before wider disclosure |
| 22 | |
| 23 | ## What not to commit |
| 24 | |
| 25 | Never commit: |
| 26 | |
| 27 | - Hugging Face tokens |
| 28 | - API keys |
| 29 | - App Store Connect keys |
| 30 | - private keys or certificates |
| 31 | - provisioning profiles |
| 32 | - local-only xcconfig files with secrets |
| 33 | - `.env` files with credentials |
| 34 | |
| 35 | ## Local development guidance |
| 36 | |
| 37 | - use local-only config for secrets |
| 38 | - keep signing identities and provisioning material outside source control |
| 39 | - replace shared App Group or bundle identifiers with values you control if you are running your own fork |