Report a vulnerability
Please report it privately, not in a public issue: security@magnetitebrowser.org
Include the affected part (browser, sync server, sync protocol, importer), the commit or version you tested, steps to reproduce, and the impact. We will acknowledge your report, keep you updated, and credit you in the fix unless you prefer not to be named. Please give us reasonable time to fix the issue before you disclose it.
Scope
-
In scope: Magnetite’s own code: the app, the
magnetite-syncserver, its protocol and cryptography, and the importer for other browsers’ data. - Bugs in Chromium or the Chromium Embedded Framework: report them upstream to Chromium or CEF, and tell us if a version Magnetite ships is affected.
- Out of scope: issues that need a development-only switch.
How Magnetite protects you
- Chromium’s sandbox, site isolation and permission prompts stay on.
- Magnetite’s own interface runs on a separate origin that web pages cannot frame, link to or load, so a page cannot reach your settings or your tabs.
-
Where an address comes from decides what may open: pages cannot open Magnetite’s own pages or local files, and
javascript:anddata:addresses never open as tabs. - A tab a page opens runs in that page’s profile, so a page in a private or separate profile never gets your main cookies.
- The data folder is readable by your user only. Logs never contain addresses, page titles, tokens or sync words.
- Sync uses HTTPS and signed requests. A malicious sync server cannot read, forge or roll back your data.
The full rules: docs/design/security.md. The policy above: SECURITY.md.