Add public security and usage disclaimers

2026-09-03 14:18:04 -04:00
parent 5adbe61ebf
commit 6e8a3948d1
2 changed files with 45 additions and 0 deletions
@@ -0,0 +1,25 @@
+# Security
+
+DataLoom is designed to process Bitwarden exports locally and offline.
+
+Bitwarden exports may contain passwords, TOTP secrets, secure notes, credit-card data, identities, custom fields, and other highly sensitive information.
+
+## Important rules
+
+- Never upload real Bitwarden exports to public repositories, issue trackers, chat systems, or third-party services.
+- Never commit real exports, merged vault files, audit logs, screenshots, crash dumps, or backups to this repository.
+- Use copies of exports for testing.
+- Review generated output and audit-log locations carefully.
+- Treat full-secret audit logs as equivalent to unencrypted password-vault files.
+- Delete or securely protect generated files when they are no longer required.
+- Use the synthetic fixtures in `tests/fixtures/` for development and testing.
+
+DataLoom does not encrypt imported files, exported files, or audit logs. Users are responsible for protecting all sensitive files created or processed by the application.
+
+## Reporting a security issue
+
+Please do not include real vault exports, passwords, tokens, or other secrets in a bug report. Describe the issue using synthetic data whenever possible. For sensitive reports, contact the repository maintainer privately rather than opening a public issue.
+
+## Scope
+
+This document describes safe handling of data processed by DataLoom. It is not a guarantee that the software is secure or suitable for production use. Review the disclaimer in `README.md` before using the application.