blitztext-app-linux/SECURITY.md

Security Policy

Blitztext App Linux is experimental software.

It is provided as-is, without warranty, support guarantees, or production-readiness claims.

Supported Versions

Only the current main branch is considered for security fixes.

Reporting A Vulnerability

Please do not open a public issue with sensitive security details.

Use GitHub private vulnerability reporting for this repository. If private vulnerability reporting is not available yet, open a minimal public issue titled Security contact request without technical details.

Do not include API keys, access tokens, private recordings, confidential transcripts, screenshots with sensitive text, or private endpoint URLs in a report.

Include:

• what you found
• how to reproduce it
• what data or system access could be affected
• your suggested fix, if you have one

Security Notes

• Blitztext types into the focused X11 window through xdotool or uses the clipboard, depending on output mode.
• Global hotkeys and synthetic typing are powerful desktop interactions; review the code before using it with sensitive workflows.
• Batch transcription may create temporary audio files during processing; the app attempts to delete them when the workflow ends or is cancelled.
• Remote STT, realtime STT, and rewrite workflows send data to the endpoints you configure.
• The app does not store API keys directly; config entries name environment variables such as OPENAI_API_KEY.
• The app does not include a hosted backend.

Do not use this preview for confidential or regulated data without your own review.