Security Disclosure
Last updated: 2026-05-21
Philosophy
Signal Guardian assumes uploads are hostile, the network is hostile, and dependencies will eventually fail. Defenses are layered (validate → cap → sanitize → parse → delete) and every optional service fails soft.
Encryption in transit
All traffic between the browser and the backend uses HTTPS/TLS when deployed to any standard host. Production builds refuse to send requests to a non-HTTPS API base URL.
Upload handling
Extension allowlist .zip .json .csv .txt. Streaming byte counter rejects oversize requests with 413. Filenames are NFC-normalized and stripped of path components and control characters. Zip archives are checked for ../, absolute paths, backslashes, member-count caps and uncompressed-size caps before extraction.
Temporary file processing
Parsers run, write only aggregates, and the raw archive is deleted in a finally block. raw_file_deleted=True is recorded with the upload row.
Session security
session_id = secrets.token_urlsafe(24) (~192 bits of entropy). Anyone holding a session_id can read or delete that session — treat it like a capability.
No silent access
The app has no path to read your Google, Meta, or Amazon account. Every byte the report is built from came from an upload you explicitly made.
Logging
Backend errors are logged server-side; the API returns generic error envelopes. Optional Sentry has send_default_pii=False and traces sampled at 0%; frontend events redact name/email/session/account/client/user IDs, tokens and notes. No request body or upload contents are written to logs.
Vulnerability reporting
Open a private security advisory on the project repository, or email the maintainer listed in the project metadata. Do not file public issues for unpatched vulnerabilities.
Responsible disclosure
We will acknowledge receipt, investigate verified issues, and credit reporters in release notes on request. Please give us a reasonable window before public disclosure and do not exfiltrate user data or degrade availability.
What we do NOT claim
Not end-to-end encrypted — the server parses your upload in plaintext to compute the report. No app-layer encryption at rest. Not SOC 2 / ISO 27001 / HIPAA / PCI certified. Not threat-actor-proof. VPN users are explicitly supported: no IP geolocation gating, no fingerprinting.
Signal Guardian provides informational privacy analysis based on user-provided data. It is not legal advice, cybersecurity certification, financial advice, forensic verification, or a guarantee of privacy protection.