search

brarcher / video-transcoder

Android app for video and audio transcoder, based on FFmpeg
GNU General Public License v3.0
481 stars 57 forks source link

Create SECURITY.md #101

Closed brarcher closed 6 years ago

licaon-kter commented 6 years ago

Why is this needed?🤷

brarcher commented 6 years ago

You must be watching my pull requests very closely to have found this so soon. (:

This is part of an effort in all of my apps to find and resolve any security issues, if they exist. On one side, I'm adding the Snyk App to my GitHub projects which checks if a dependency has known security vulnerabilities (CVEs). That should help flag potential issues. However, it is still possible there is a bug in the ffmpeg binary used or one of its dependencies which, if exploited, in the worse case could result in arbitrary code execution when attempting to encode a video. I think the damage to such a inflicted attack would be limited from Android's own protection model.

Generally, because this app does not connect to the Internet, if there were a security vulnerability it would have low impact. However, if someone were to find an issue, I wanted it to be more clear how they should report it. Let me know if it is not clear.

licaon-kter commented 6 years ago

I watch the repo, hence... :eyes:

Thanks for the info

brarcher commented 6 years ago

Oh. I've never noticed the watch setting before now. That makes more sense. (:

licaon-kter commented 6 years ago

You get notified for issues, PRs, and your main feed has the repo commits too.