Security

Reporting a vulnerability, and the audit history.

Stalkrr captures meetings and voice calls. A security or privacy bug here can expose extremely sensitive data, so we treat the following as security issues, not ordinary bugs:

• Anything that sends captured data off-device unexpectedly.
• Anything that bypasses or weakens the redaction stage.
• Anything that bypasses the Terms/erase model — e.g. captured data that cannot be erased.
• Leakage of BYO-AI keys or other secrets.
• A mismatch between what the open code appears to do and what it actually does with captured data.

Reporting a vulnerability

Please do not open a public issue or PR for security/privacy vulnerabilities.

Report privately:

• Use GitHub Security Advisories ("Report a vulnerability") on this repository — that channel reaches the maintainers privately.

The verifiable inventory of every network connection the app can make lives in PRIVACY.md; anything off-device that isn't listed there qualifies as a vulnerability.

Please include: affected version/commit, a description, reproduction steps, and the data-boundary impact. We aim to acknowledge within a few business days. Please give us reasonable time to remediate before public disclosure (coordinated disclosure).

Supported versions

Alpha, under active daily development. Only the latest release on stalkrr-releases is supported — installed builds self-update, so staying current is automatic. Treat the software's judgment-free capture with the care it deserves: you are responsible for recording lawfully (see docs/CONSENT.md).

Audit history

• 2026-09-01 — external review. Five findings, all confirmed: Terms acceptance did not gate capture; "redacted frames" was claimed but frames are sent unredacted; per-participant opt-out was documented but not implemented; the MCP delete_meeting tool allowed path traversal; erase/discard could report success while data remained. Fixed in 0.7.7 (deletion hardening) and 0.8.0 (the rest). One deliberate deviation from the reviewer's recommendation: the MCP delete tools remain enabled by default, hardened and logged, with an off-switch in Settings.