Security Policy

Security and privacy model

Manuscript Compiler is an offline Obsidian plugin. It reads manuscript notes through documented Obsidian Vault APIs, prepares a semantic Book in memory, generates export bytes in memory, validates those bytes, and initiates a browser/host-controlled download.

The production plugin has:

no background network requests; user-selected support and funding links may open an external website;
no telemetry, analytics, advertising, accounts, or cloud service;
no remote fonts, stylesheets, scripts, or assets;
no Electron bridge or Node filesystem export;
no shell, child_process, external executable, or conversion tool;
no dependency on another Obsidian community plugin;
no active Pandoc integration;
one production dependency, fflate, for ZIP generation and inspection.

Manuscript data

Manuscript content remains on the device. Source notes are read and never changed by preparation or export. Completed manuscript exports are not written into the vault, including as temporary, recovery, hidden, or compatibility files.

The explicit diagnostics action is separate from manuscript export. At the user's request it may create a redacted Markdown support note through Obsidian's Vault API. Diagnostics must not contain manuscript prose, private metadata values, absolute paths, usernames, environment variables, Blob URLs, or external destinations.

Browser download boundary

After validation, BrowserDownloadService:

creates a Blob from generated bytes and the exact format MIME type;
creates an object URL;
assigns URL and filename as anchor properties;
appends and clicks one temporary download anchor;
removes the anchor;
revokes the object URL on success or failure.

The operating system, browser, or Obsidian host controls the final destination. The plugin cannot observe or persist that path and cannot prove that the host completed the external filesystem write. If dispatch fails, the plugin reports failure and does not fall back to a vault write.

Persisted data

Plugin settings contain profiles, formatting defaults, bounded export history, and bounded compile logs. Repair treats persisted data as untrusted. Histories and logs retain structural counts and terminal statuses, not manuscript content or paths. Historical fields for removed behavior can remain for idempotent migration but cannot activate old execution routes.

Package and dependency integrity

Official release assets are exactly:

main.js
manifest.json
styles.css

The optional release ZIP contains only those three files. The repository's logo.svg is validated as branding source and compiled into main.js; it is not read from disk at runtime or included in the release package. Use assets from one release tag and verify that the tag exactly matches the version in manifest.json. Dependency changes require lockfile review, licence review, audit, updated third-party notices, and explicit approval. Runtime dependencies must not be introduced as convenience wrappers around platform, export, or network behavior.

Supported versions

Security fixes are provided for the current prerelease line while it is actively maintained. The repository does not promise security updates for older builds. Reproduce issues against the latest available release before reporting when practical.

Reporting a vulnerability

Do not publish a suspected vulnerability, private vault path, manuscript excerpt, access token, or exploit detail in a public issue.

Report privately through GitHub's Security → Report a vulnerability feature for this repository. Include:

affected version and Obsidian version;
operating system and mobile/desktop status;
a concise impact description;
minimal reproduction steps using synthetic content;
whether source-note modification, data disclosure, path disclosure, unexpected network activity, unsafe download behavior, or code execution is involved;
relevant redacted logs or diagnostics;
any proposed mitigation.

If private GitHub vulnerability reporting is unavailable, contact the repository owner through the private contact method listed on the maintainer's GitHub profile. Do not attach a real manuscript or vault archive.

Reports will be acknowledged when maintainers are available, assessed for reproducibility and impact, and handled through a coordinated fix/release process. No fixed response-time SLA is promised for this independently maintained project.

Out of scope

The following are generally outside the plugin's security boundary unless they expose a plugin defect:

operating-system or browser download-location behavior;
malicious modifications made after a release asset is downloaded;
vulnerabilities in Obsidian itself;
a compromised vault, device, or third-party application used to open exports;
presentation differences between document readers;
denial of service requiring intentionally extreme synthetic input without a realistic author workflow.

Reports showing that the plugin violates its offline, privacy, validation, or delivery guarantees remain in scope.

5.1 KiB Raw Permalink Blame History