Only the latest release receives security updates. Please always update to the most recent version.

If you discover a security vulnerability in SSPU-AllinOne, please report it responsibly.

Do NOT open a public GitHub Issue for security vulnerabilities.

Instead, please report via email to:

qintanshiguang@163.com

• A description of the vulnerability
• Steps to reproduce the issue
• The potential impact
• Any suggested fix (if available)

• Acknowledgment: within 48 hours
• Initial assessment: within 5 business days
• Fix or mitigation: depends on severity, typically within 14 days for critical issues

• You will receive an acknowledgment of your report
• We will work with you to understand and validate the issue
• A fix will be developed and tested privately
• A security advisory will be published when the fix is released
• You will be credited in the advisory (unless you prefer to remain anonymous)

This policy covers the SSPU-AllinOne application code in this repository, including:

• Flutter application code (lib/)
• Platform-specific code (android/, ios/, macos/, linux/, windows/)
• Build and release scripts (scripts/, .github/)

• Third-party dependencies (report to their respective maintainers)
• Social engineering attacks
• Issues requiring physical access to the user's device

• Never commit secrets, API keys, tokens, passwords, or credentials
• Use flutter_secure_storage for sensitive user data
• Do not log sensitive information
• All external network requests should be validated
• User data stays on device — do not introduce cloud sync without explicit discussion

This security policy is adapted from standard open source security practices.