Security Center · Eidovara

Desktop safeguards

Context isolation, renderer sandboxing (app.enableSandbox() before ready), navigation blocking, and narrowly scoped audio-only permissions.
Secrets encrypted through the operating system when secure storage is available.
HTTPS-only public services and checkout links; SHA-512/SHA-256 verification before updater install. Builds are Authenticode-unsigned.
No automatic external safety reporting and no payment-card storage.
Future packaged builds from this source flip Electron fuses (no ELECTRON_RUN_AS_NODE, cookie encryption, ASAR integrity, no extra file:// privileges). This page does not rebuild the live v2.1.4 Setup.exe.

Release integrity

Official releases ship with checksums, an SBOM, privacy declaration, code-signing status, and build provenance. Public installer distribution is temporarily unavailable while the next development phase is built and tested; when distribution resumes, integrity material returns with it. Provenance is not Authenticode.

Website helper

Ask Eidovara answers from an allowlisted knowledge pack. Optional /v1/assist accepts a single question, refuses desktop conversation history, and does not store transcripts. Tight Content-Security-Policy on these pages; connect is limited to this origin and HTTPS.

Network inventory

Current egress is Wikipedia/Wikimedia after an explicit research request, optional pasted HTTPS model providers, Premium Brave with a user key, official GitHub update checks, optional Worker /health, /v1/config, /v1/status (desktop, default https://api.eidovara.org) and /v1/assist (website helper after a saved HTTPS base), and Spotify/YouTube HTTPS search links. See NETWORK-USAGE.md. Payments stay fail-closed. No workers.dev host is compiled into the app. Local media uses media-src https: eidovara-media:, never media-src 'self'.

Repository checks

The public GitHub repository runs CodeQL, OpenSSF Scorecards (SARIF to code scanning), pnpm audit, a license inventory, Dependabot for npm and GitHub Actions, and a prohibited-secret scan. Dependency review stays configured at fail-on-severity: moderate but cannot run until the owner enables Dependency graph. Private vulnerability reporting is an owner toggle, not something this page can switch on. These checks are not Authenticode, PCI, or a perfect-security claim.

Not enabled

Source v2.1.4 does not bundle neural TTS, VRM, or OBS websocket control, and does not turn on live checkout. The live installer remains v2.1.4. Dependency review continues to fail on moderate severity. The renderer stays sandboxed. These are product limits, not a perfect-security or PCI claim. Adults 18+. Source-available, not open source. Authenticode-unsigned Windows.

Report a vulnerability

Use the repository's private security-advisory channel when the owner has enabled it. Never place credentials, private keys, personal records, or exploit details in a public issue. No software is guaranteed perfectly secure.