Security Policy

This document defines the security boundaries, safety principles, and vulnerability reporting procedures for the External Overlay project.

1. Security & Safety Model

The project is built around a non-intrusive desktop presentation model designed for software research and user interface architecture studies.

Non-Intrusive Engine: The application operates as an independent, standalone user-mode desktop process. It does not inject code or dynamic-link libraries (DLLs) into external applications.
Read-Only Data Processing: The default data processing pipeline operates strictly in read-only mode, retrieving structure layout values without writing to external process memory.
External Configuration Isolation: Settings and layout preferences are stored in external JSON files (configs/*.json), preventing runtime code execution or binary modifications.

We take security issues seriously. If you discover a security vulnerability or safety issue within this repository:

Do Not Open Public Issues: Please refrain from opening public GitHub issues for undisclosed security vulnerabilities.
Contact Maintainers: Submit your vulnerability report directly to the repository maintainers via GitHub Security Advisories or by contacting qafaraz.
Include Details:
- A description of the vulnerability and affected components.
- Minimal steps or proof-of-concept to reproduce the issue.
- Potential impact of the vulnerability.

We will acknowledge receipt of your report within 48 hours and work with you to address identified issues promptly.

Contributors modifying the codebase must follow these safety guidelines:

Input Validation: Validate all external inputs, including JSON files (configs/*.json and output/*.json), to prevent buffer overflows or malformed schema crashes.
Third-Party Dependencies: Keep vendor libraries under vendor/ updated against known vulnerabilities.
Memory Safety: Utilize modern C++20 standard library abstractions, smart pointers, and RAII primitives to ensure deterministic resource management.
No Hardcoded Secrets: Never commit credentials, private keys, or sensitive environment tokens to version control.

For general technical queries or build assistance, refer to FAQ.md.