26 lines
1.5 KiB
Markdown
26 lines
1.5 KiB
Markdown
# Security
|
|
|
|
DataLoom is designed to process Bitwarden exports locally and offline.
|
|
|
|
Bitwarden exports may contain passwords, TOTP secrets, secure notes, credit-card data, identities, custom fields, and other highly sensitive information.
|
|
|
|
## Important rules
|
|
|
|
- Never upload real Bitwarden exports to public repositories, issue trackers, chat systems, or third-party services.
|
|
- Never commit real exports, merged vault files, audit logs, screenshots, crash dumps, or backups to this repository.
|
|
- Use copies of exports for testing.
|
|
- Review generated output and audit-log locations carefully.
|
|
- Treat full-secret audit logs as equivalent to unencrypted password-vault files.
|
|
- Delete or securely protect generated files when they are no longer required.
|
|
- Use the synthetic fixtures in `tests/fixtures/` for development and testing.
|
|
|
|
DataLoom does not encrypt imported files, exported files, or audit logs. Users are responsible for protecting all sensitive files created or processed by the application.
|
|
|
|
## Reporting a security issue
|
|
|
|
Please do not include real vault exports, passwords, tokens, or other secrets in a bug report. Describe the issue using synthetic data whenever possible. For sensitive reports, contact the repository maintainer privately rather than opening a public issue.
|
|
|
|
## Scope
|
|
|
|
This document describes safe handling of data processed by DataLoom. It is not a guarantee that the software is secure or suitable for production use. Review the disclaimer in `README.md` before using the application.
|