The following versions of HidaChat are currently supported with security updates:
| Version | Supported |
|---|---|
| 0.3.x | ✅ |
| 0.2.x | ✅ |
| < 0.2.0 | ❌ |
Security is a top priority for HidaChat. If you discover a security vulnerability, please follow these guidelines:
- Do NOT open a public GitHub issue for security vulnerabilities.
- Report the vulnerability privately by opening a Private Security Advisory on GitHub or contacting the maintainer directly via GitHub profile.
- Include detailed information:
- Type of issue (e.g. credential leakage, XSS in webview bridge, unauthorized RPC).
- Step-by-step instructions to reproduce the issue.
- Proof-of-concept code or screenshot if applicable.
- WebView2 Profile Isolation: User sessions and cookies are isolated per account in
data/webview/. - No Remote Code Execution: Script injection in
JsScripts.vbis strictly scoped to local UI handling and message translation. - GitHub Release Verification: Automatic updates use HTTPS calls directly to
https://api.github.com/repos/hidaba/HidaChat/releases/latest.
Thank you for keeping HidaChat and its users safe!