From b33d300d0ba5694225056b3e00527f5703c07239 Mon Sep 17 00:00:00 2001 From: Jason Date: Wed, 29 Jul 2026 00:04:42 +0800 Subject: [PATCH] docs(security): document the threat model and reporting scope The policy explained how to report but never what counts as a vulnerability, so any finding phrased as "IPC command X, given parameter Y, writes a file" arrived as a valid report. Records the trust boundary as a scoping decision supported by four checkable facts about the shipped renderer, each with the condition that would invalidate it. The exemption covers only reports whose sole route to the IPC surface is DevTools or a locally modified frontend; a chain starting from a deep link, remote data, an inbound proxy request or an XSS stays in scope. Trust in the renderer covers the code we ship, not arbitrary values flowing through it. Notable corrections to the first draft, from review: - the app is not free of server components: it runs a local HTTP proxy whose listen address is user-configurable and may be non-loopback. Inbound requests to it are now listed as untrusted input - "no remote content" was already false. The renderer fetches model pricing JSON and provider avatars, which CSP permits. Narrowed to remote *executable* content, and the remote data it does fetch is named and classified as untrusted - having the same filesystem permissions as the user does not make a write the user's decision. Confused-deputy cases, where an untrusted source controls the path or content, are in scope - user-authored integrations that run commands are out of scope; the same integrations arriving by import or deep link are not, and the required property there is informed consent - being in scope here and meeting GitHub's CVE eligibility criteria are separate questions, decided by different parties --- SECURITY.md | 104 +++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 103 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index d97590e26..807ec6054 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -11,6 +11,93 @@ Only the latest release of CC Switch receives security updates. | Latest 3.x | ✅ Yes / 是 | | < 3.0 | ❌ No / 否 | +## Threat Model / 威胁模型 + +CC Switch is a local desktop application. It manages configuration files for AI coding CLIs on the user's own machine. There is no project-operated cloud backend, no multi-user model, and no privilege separation from the user who runs it. + +CC Switch 是一个本地桌面应用，用于管理本机上各 AI 编程 CLI 的配置文件。本项目不运营任何云端后端，没有多用户模型，也不与运行它的用户之间存在权限隔离。 + +It does, however, run a **local HTTP proxy** whose listen address and port are user-configurable and **may be bound to a non-loopback interface**. Requests arriving at that listener are untrusted input and are in scope — see Scope below. + +但它会启动一个**本地 HTTP 代理**，其监听地址与端口可由用户配置，**可能绑定到非 loopback 接口**。抵达该监听端口的请求属于不可信输入，在范围内——见下方「范围」。 + +### The bundled renderer is inside the trust boundary / 打包的渲染进程属于信任边界之内 + +The bundled WebView renderer is treated as a trusted component. This is a **scoping decision, supported by the facts below rather than derived from them** — the facts are what make the decision checkable, and if any ceases to hold the decision must be revisited. Verified against v3.18.0: + +打包的 WebView 渲染进程被视为可信组件。这是一项**范围划定决策，由下列事实支撑，而非从中必然推出**——这些事实的作用是让该决策可被核验；一旦任一条不再成立，该决策必须重新评估。已针对 v3.18.0 核实： + +1. **No remote executable content is loaded.** `frontendDist` is bundled at build time (`src-tauri/tauri.conf.json`); the codebase contains no `