Security policy#

Supported versions#

VTune v2 is currently a private alpha. Security fixes target the latest release or the current main branch before the first public release.

Reporting a vulnerability#

Do not open a public issue for vulnerabilities, credential exposure, private library access, invitation bypasses, path traversal, or arbitrary media access. Contact the maintainer privately through the repository hosting the checkout. After stable v2 publication, use the private security-reporting channel listed in the public repository. Include:

• the affected version or commit;
• a minimal reproduction;
• the expected and observed authorization boundary;
• whether uploaded media or credentials may have been exposed.

Do not include real Discord tokens, OAuth secrets, session cookies, invitation links, private audio, or personal information in a report.

Security boundaries#

• VTune has no public media download endpoint.
• Audio files are stored under generated keys inside the persistent data volume.
• Discord OAuth uses only identify; access tokens are discarded after login.
• Invitation, setup, OAuth-state, session, and CSRF tokens are stored as hashes.
• A self-hosted operator controls the database and media volume and therefore is not cryptographically hidden from user content.