# Security

## Offline Guarantee

StepForge ships with **zero network code paths**. The application:

- opens no sockets and performs no HTTP requests,
- has no telemetry, crash reporting, or analytics,
- performs no update checks and no license validation,
- has no account system, cloud sync, or remote AI integration,
- embeds no remote fonts, CDNs, or external references in exports.

The only network activity in the project's lifetime is the one-time
development fetch of the Electron shell via npm (see
`build/agent_audit.md`). The packaged app never goes online.

## Threat Model

Because the app is local-only, the realistic attack surface is **malicious
files opened by the user**:

### Archive imports (`.sfgz`, `.sfglt`)

Both formats are zip files. The reader in `core/zip.js` validates every entry
before extraction:

- entry names must be relative, must not contain `..` segments, drive
  letters, or absolute paths;
- entries are extracted only beneath the destination directory (resolved
  path is verified to stay inside it);
- file sizes are taken from actual inflated data, not trusted headers;
- unknown entries outside the documented layout are ignored.

### Image imports (PNG/JPEG/GIF)

Imported images are decoded by the platform image codecs in the Electron
shell and re-encoded to PNG before storage. The pure-JS PNG decoder in
`core/png.js` (used by exporters) rejects malformed dimensions, oversized
allocations, and bad CRCs.

### Linked guides and lock files

Shared `.sfgz` files opened in *linked mode* use a sidecar lock file
(`<name>.lock-sfgz`) containing the holder's machine name and timestamp.
This is an advisory lock for coordination on shared folders, **not** a
security boundary: a hostile or crashed peer can delete it. Conflicts are
surfaced to the user with keep-editing / discard options; the format is
last-write-wins and that risk is documented in the UI.

### Local data at rest

The guide store is **not encrypted at rest** — it inherits the user account's
filesystem protections, like any document folder. If you need encrypted
sharing, encrypt the `.sfgz` with external tooling; native encrypted archives
are a tracked enhancement, not a current feature.

## Renderer Hardening

The Electron renderer runs with `contextIsolation: true` and
`nodeIntegration: false`; the only privileged surface is the explicit
allowlisted IPC API in `app/preload.js`. Guide description HTML is sanitized
(allowlisted tags/attributes, no scripts, no event handlers, no external
URLs) before storage and again before rendering or export.

## Reporting

Report vulnerabilities by opening an issue marked `security` (this is a
local-only tool, so coordinated disclosure pressure is low; do not include
exploit archives directly — describe the structure instead).