Security

Web pages are untrusted, and they never share a channel with the terminal or the file system.

• Each tab is a sandboxed view (Chromium's sandbox, context isolation, no Node) in its case's own session. Its preload exposes nothing: it only installs the page scripts. The native side answers commands only from the app's own view, loaded from its own app:// scheme under a strict Content Security Policy. The end-to-end test confirms, from inside a live page, that no bridge or Node is reachable.
• The app reads pages only through the bundled read-only scripts in packages/ui/page-scripts/, receiving their JSON result. After a page loads it reads the results list (results pages) or declared metadata and link counts (other pages); page text and selections are read only when you capture.
• Tabs can only navigate to http(s), blob: and about:blank. Popups become tabs. Pages get no camera, microphone, location, notification or device access. Downloads go to Downloads without overwriting.
• A paused case's sessions refuse every request before it leaves the computer, not only navigations. Routed sessions send loopback traffic through the route too; WebRTC is removed from pages and limited to proxied connections; DNS prefetching is off.
• The agent terminal runs an allowlisted command (Claude Code, Codex or your login shell) in the workspace. The UI cannot choose the command or directory. After a capture, it types only IDs and a sanitized case title.
• Server requests go through the main process, confined to /api/ paths on the configured server, via the typed client generated from the server's OpenAPI contract. The API token (hosted servers) is kept encrypted by the operating system and added natively; remote servers must use HTTPS.
• Replayed snapshots run archived scripts, so they are served from the server's separate replay origin, which has no API; the main origin refuses API requests from other sites' pages. The end-to-end test probes both from inside a replay.
• Installed apps never fall back to the build machine's repository.
• Packaged apps flip Electron's security fuses before signing: cookies are encrypted with the operating system's credential store; ELECTRON_RUN_AS_NODE, NODE_OPTIONS, inspector arguments and file-protocol privileges are disabled; and the app must load from its integrity-checked ASAR.

HVNT33 holds sensitive research: private investigations, evidence files and notes about real people. Security reports are welcome and taken seriously.

Reporting a vulnerability§

Please report vulnerabilities privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Do not open a public issue, pull request or discussion for a suspected vulnerability.

Include what you found, how to reproduce it, the version or commit, and the impact you believe it has. You will get an acknowledgement within 5 working days, and we will keep you informed until it is fixed. We credit reporters in the release notes unless you prefer otherwise.

Scope§

In scope:

• The desktop app (apps/desktop): browsed pages gaining app capabilities or reaching the terminal, the file system or the API token; navigation-policy bypasses.
• The server (apps/server): authentication and workspace isolation in token mode, access to another workspace's data, path traversal in the evidence vault, server-side request forgery in snapshots, replay-link forgery, archived pages reaching the API.
• Evidence integrity: ways to alter stored evidence, manifests or timestamp tokens without detection.
• The research CLI and agent workflow: page content causing the agent terminal to run commands.

Out of scope: vulnerabilities in search engines or the Internet Archive, social engineering, denial of service against a local server, and issues that need an attacker who already controls your user account.

Security model§

The design is described in docs/ARCHITECTURE.md and apps/desktop/README.md. The local server trusts requests from your own machine; do not expose it to a network. Token mode is the hosted shape.

Supported versions§

Before 1.0, only the latest release receives security fixes.