We take security issues seriously. If you discover a security vulnerability, please follow the process below.

我们非常重视安全问题。如果您发现安全漏洞，请按照以下流程操作。

1. DO NOT create a public GitHub issue for security vulnerabilities.

   不要为安全漏洞创建公开的 GitHub Issue。

2. Send an email to: support@deepstudent.cn (or use GitHub Security Advisories if available)

   请发送邮件至：support@deepstudent.cn（或使用 GitHub Security Advisories，如可用）

3. Include the following information:

   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

   请包含以下信息：

   • 漏洞描述
   • 复现步骤
   • 潜在影响
   • 建议的修复方案（如有）

1. Acknowledgment: We will acknowledge receipt of your report within the SLA timeframe.

   确认：我们将在 SLA 时效内确认收到您的报告。

2. Investigation: Our security team will investigate and validate the report.

   调查：我们的安全团队将调查并验证报告。

3. Updates: We will keep you informed of our progress.

   更新：我们将持续通知您进展情况。

4. Resolution: Once resolved, we will notify you and coordinate disclosure.

   解决：问题解决后，我们将通知您并协调披露事宜。

5. Credit: With your permission, we will acknowledge your contribution in the release notes.

   致谢：经您许可，我们将在发布说明中致谢您的贡献。

• Always download releases from official sources (GitHub Releases / Official Website)
• Keep the application updated to the latest version
• Be cautious when importing data from untrusted sources
• Review MCP server configurations before enabling

• Follow the secure coding guidelines in CODE_STYLE.md
• Never commit secrets, API keys, or credentials
• Use the secure store API (secure_store.rs) for sensitive data
• Review third-party dependencies before adding

• DeepStudent desktop application (Windows, macOS, Linux)
• DeepStudent mobile application (iOS, Android)
• Official MCP server integrations
• Data storage and encryption mechanisms

• Third-party MCP servers
• User-configured external services
• Issues in upstream dependencies (report to respective projects)

DeepStudent implements the following security measures:

DeepStudent 实现了以下安全措施：

• Local-first data storage: All user data stored locally by default

  本地优先数据存储：所有用户数据默认存储在本地

• AES-256-GCM encryption: Sensitive data (API keys) encrypted at rest via secure_store.rs

  AES-256-GCM 加密：敏感数据（API 密钥）通过 secure_store.rs 静态加密

• MCP allow/deny lists: Configurable tool access controls

  MCP 允许/拒绝列表：可配置的工具访问控制

• CSP (Content Security Policy): The CSP has been hardened (script-src 'self', no unsafe-eval, explicit connect-src allowlist, withGlobalTauri disabled). Remaining relaxations: style-src 'unsafe-inline' (required by the styling pipeline) and img-src https: (user-provided remote images).

  CSP（内容安全策略）：CSP 已加固（script-src 'self'、无 unsafe-eval、connect-src 为显式域名白名单、withGlobalTauri 已禁用）。仍保留的放宽项：style-src 'unsafe-inline'（样式管线所需）与 img-src https:（用户引用的远程图片）。

• File system permissions: The application requests broad file system access (user directories) for resource management. Users should be aware of this when granting permissions.

  文件系统权限：应用请求较广泛的文件系统访问权限（用户目录），用于资源管理。用户在授权时应注意这一点。

Thank you for helping keep DeepStudent and our users safe!

感谢您帮助保护 DeepStudent 和我们的用户安全！