RewindBox is a developer-security tool: it snapshots workspace state, manages an encrypted vault, and enforces per-command firewall policies. Security correctness is a first-class requirement, not an afterthought. We take vulnerability reports seriously and respond quickly.

Please do not open a public issue for a security problem. Instead, report it privately so it can be fixed before disclosure.

If you have a GitHub account:

Open a private report at https://github.com/yassine-ceo/rewindbox/security/advisories and follow the on-screen steps. You will receive a response within 48 hours.

Otherwise, send an email describing the issue to security@rewindbox.dev with the subject line [SECURITY].

Whichever channel you use, please include:

• The affected command, flag, or data path.
• A minimal reproduction (commands and inputs).
• The impact (what an attacker can gain and who can trigger it).
• Your environment (OS, RewindBox version from rewindbox --version).

You do not need to include a fix; a clear reproduction is enough.

1. Acknowledge the report within 48 hours.
2. Triage — confirm the issue and assess severity and impact.
3. Fix — develop, review, and test a fix. Fixes that touch the engine, vault, firewall, or audit journal ship with regression tests.
4. Release — a patched release is cut, and the advisory is published on GitHub so users can upgrade.
5. Credit — reporters are credited in the advisory unless they prefer to stay anonymous.

The following are in scope:

• The Rust crate in rewindbox/: snapshot, vault, firewall, journal, hooks, and CLI parsing.
• The installer scripts (install.cmd, install.ps1, install.sh and the scripts under rewindbox/scripts/).
• The GitHub Actions workflows in .github/workflows/.

The following are out of scope and generally not eligible for bounty or credit:

• Issues that require physical access or already-compromised hosts.
• Denial of service that requires local execution on the victim's own machine.
• Security issues in third-party dependencies — report those to the dependency's maintainers instead.

Security fixes are applied to the latest stable release. We do not maintain separate LTS branches; please stay on the newest version.