Security Policy
Relevant source files
The following files were used as context for generating this wiki page:
The Security Policy of the OpenHWP project defines the protocols for identifying, reporting, and mitigating vulnerabilities within the HWP/HWPX desktop application. As a project built on the Deno desktop runtime and the rhwp engine, the policy ensures that security concerns are handled through private channels to protect users and maintain the integrity of the document processing environment.
This policy applies to all components of the OpenHWP stack, including the desktop shell and the WebAssembly-based document engine. Community members are required to follow these guidelines rather than utilizing public issue trackers for security-sensitive disclosures.
Sources: SECURITY.md:1-5, README.en.md:5-10, CONTRIBUTING.md:68-69
Supported Versions
OpenHWP provides active security maintenance for the primary release branch. Because the project is in an early development stage, users are encouraged to stay on the latest version to receive critical patches.
| Version | Supported |
|---|---|
| latest | :white_check_mark: |
| older | :x: |
The maintainers reserve the right to provide fixes for older versions at their discretion, though this is not guaranteed.
Sources: SECURITY.md:3-12
Vulnerability Reporting Process
To prevent exploitation before a fix is available, the project mandates a private disclosure process. Reporters should not use public GitHub issues, discussions, or pull requests for security vulnerabilities.
Reporting Channels
The project provides two primary private channels for reporting:
- GitHub Private Reporting: Accessed via the Security tab on the repository, selecting "Report a vulnerability".
- Email: Reports can be sent directly to security@pleaseai.dev.
Sources: SECURITY.md:14-23
Required Information for Reports
To facilitate a rapid response, reports should include the following details:
- A comprehensive description of the vulnerability.
- The potential impact of the exploit.
- Step-by-step instructions to reproduce the issue or a proof of concept (PoC).
- Affected software versions and any identified temporary mitigations.
Sources: SECURITY.md:25-29
Handling Workflow
The following diagram illustrates the lifecycle of a security report from initial submission to public advisory:
The maintainers aim to acknowledge receipt within 72 hours and provide updates throughout the remediation process.
Sources: SECURITY.md:31-38, CONTRIBUTING.md:41-45
Security in Development and Infrastructure
OpenHWP utilizes specific architectural choices and tooling to maintain a secure development environment and application runtime.
Runtime and Backend Security
The application leverages the Deno toolchain and Chromium (CEF) backend. By serving the application from localhost, it operates within a Secure Context, which is a prerequisite for using modern web APIs like the File System Access API.
The use of WebAssembly for the document engine (rhwp) provides an additional layer of isolation for document parsing tasks.
Sources: README.en.md:14-35, README.md:14-35
Development Tooling Security
Project infrastructure is managed through orca.yaml and Deno task runners. The setup script handles local environment variables and gitignored files (like .env) securely during worktree creation.
- Workflow Integrity: Pull requests from external contributors are restricted; maintainers open "approval PRs" after discussion to prevent unvetted code from entering the main branch.
- Dependency Management: Dependencies are cached via
deno install, ensuring a consistent and predictable toolchain.
Sources: CONTRIBUTING.md:38-45, orca.yaml:12-18
Code of Conduct and Enforcement
Security also extends to the community environment. Harassment or the publication of private information is strictly prohibited and handled by community leaders.
- Reporting Misconduct: Instances of abusive behavior can be reported to the same security address: security@pleaseai.dev.
- Confidentiality: Community leaders are obligated to respect the privacy and security of the reporter during any investigation.
Sources: CODE_OF_CONDUCT.md:33-35, CODE_OF_CONDUCT.md:52-60
Conclusion
The OpenHWP Security Policy prioritizes private disclosure and rapid response to maintain a safe environment for HWP document processing. By combining strict reporting protocols, a secure Deno-based architecture, and proactive community moderation, the project ensures that vulnerabilities are addressed before they can be publicly exploited.