Security Policy
This document has two jobs: (1) tell security researchers how to report a vulnerability privately, and (2) explain to users how Novara protects their data and what it does not protect.
1. Supported versions
Security fixes are provided for the versions below. We strongly recommend always running the latest release.
| Version | Status | Notes |
|---|---|---|
| 5.0 | ✅ Supported | Current release |
| 4.0 | ✅ Supported | Receives critical fixes where feasible |
| 3.0 | ✅ Supported | Receives critical fixes where feasible |
| 2.0 | ⚠️ Legacy | Uses the older AES-CBC encryption; upgrade recommended |
| < 2.0 | ❌ Unsupported |
2. Reporting a vulnerability
We take security reports seriously and will never penalize good-faith security research.
Please report privately first — do not open a public issue with exploit details.
- Preferred: GitHub → Security tab → Report a vulnerability (Private Vulnerability Reporting).
- Alternative: Email owner@novara.xin with the subject line
[Security] ....
Please include:
- the affected version(s);
- a clear description of the issue and its potential impact;
- steps to reproduce (or a proof of concept), if available;
- any suggested fix (optional).
What to expect:
- We aim to acknowledge your report within 5 business days.
- We will keep you updated on our assessment and fix plan.
- High-severity issues will not be disclosed publicly until a fix is released.
- Credit: we are happy to credit reporters in release notes unless you ask to remain anonymous.
3. Security model & threat model
What we protect. Novara is a local-first application. Its security goal is to protect your data at rest — the single database file on disk — against:
- casual or unauthorized reading when the app is locked or closed (via optional encryption);
- silent tampering of the encrypted file (via AES-GCM authentication);
- accidental data loss (via atomic writes, a recycle bin, and local backups);
- brute-force guessing of the lock password (via lockout and a monotonic clock).
What we do NOT protect (honest limits). A local application cannot defend against everything. Novara does not protect against:
- An unlocked session — an attacker who can operate your machine can see what you see.
- Malware on your machine — keyloggers, screen recorders, RATs, or a compromised Windows account.
- Physical access — someone with physical access to your unlocked device.
- A lost/forgotten password — by design there is no recovery.
- Memory extraction — encryption keys exist in memory while the app is unlocked.
Bottom line: Novara's encryption protects your data at rest on disk. It is not a substitute for a healthy, malware-free, physically-secured machine.
4. Encryption architecture
When the privacy lock is enabled, Novara encrypts the entire database:
| Aspect | Detail |
|---|---|
| Cipher | AES-256-GCM (authenticated encryption), 256-bit key |
| Key derivation | PBKDF2-SHA256, 100,000 iterations, per-user random 32-byte salt |
| Password | 6–64 characters; only salted SHA-256 hashes stored locally |
| Authentication | 12-byte random nonce + 16-byte GCM tag — any tampering is detected |
| Data flow | JSON → GZip compression → AES encryption → on-disk file |
| Migration | Legacy v1 (AES-CBC, Novara 2.0) auto-migrates to v2 (GCM) after one confirmation |
Important: encryption is off by default. Without the privacy lock, the database is a plaintext JSON file (protected only by your Windows account permissions). This is a deliberate design choice so casual users are never locked out of their own data.
5. Data integrity & reliability
- Atomic writes — every save writes to a temporary file, flushes to disk, then atomically replaces the original.
- Single-writer discipline — a debounced/serialized save queue and a single-instance mutex prevent concurrent writers.
- Exclusive file lock + Hidden/ReadOnly attributes — reduce accidental modification.
- Recycle bin (soft delete) — deleted cards are recoverable for 7 days.
- Rolling local backups — up to 10 local snapshots you can restore from.
- Crash logs (local, redacted) — sensitive values (e.g. API keys) are redacted and never auto-uploaded.
- Integrity checks — the export format carries a 16-byte MD5 header; imports are validated and rolled back on failure.
6. Anti-brute-force & lockout
- After 5 consecutive wrong passwords, unlocking is blocked for 30 minutes.
- The failure count and lock deadline persist across restarts (
lockout.dat). - The lockout uses a monotonic clock (
Environment.TickCount64), preventing a bypass by rolling the system clock backward. - The lock screen clears its input when the window loses focus.
7. Version compatibility & downgrade warnings
| Scenario | Behavior |
|---|---|
| 2.0 data opened in 3.0/4.0/5.0 | ✅ Read and migrated from AES-CBC (v1) to AES-GCM (v2) |
| 3.0/4.0/5.0 data opened in 2.0 | ❌ Not readable — 2.0 does not understand the GCM format |
| 3.0 ↔ 4.0 ↔ 5.0 | ✅ Same format (v2 GCM); compatible |
⚠️ Before downgrading or rolling back to 2.0, export a plaintext backup. Once a database has been migrated to GCM, older versions cannot open it.
8. Application hardening
- XSS protection in the editor — rich-text HTML is sanitized on load, save, and navigation against a strict whitelist (AngleSharp). Script tags,
on*attributes, and dangerous protocols are stripped. Titles render as plain text. - No code evaluation of untrusted input — imported HTML and JSON are parsed and normalized, never executed.
- Local-only helper process — the desktop-sticky-note helper communicates via local files and named events; no network requests, no listening ports.
- Minimal surface — no listening network ports, no HTTP server. The only outbound network calls are the user-triggered API-key detection tiers. The MCP server is a local named-pipe endpoint only.
9. Developer commitments
- Never operating a cloud server that collects user data.
- Never adding a backdoor, a password-recovery bypass, or any remote unlock/exfiltration mechanism.
- Never adding telemetry, analytics, or ads.
- Never auto-updating or auto-uploading data without explicit user action.
- Disclosing security issues transparently: fix first, then publish, with credit to reporters.
10. MCP interface security model
The optional MCP interface lets an AI agent read and write cards. Its security model is defense-in-depth:
- Off by default — disabled until you enable it in Settings and copy a token.
- Token authentication — a per-user token, compared in fixed time (
CryptographicOperations.FixedTimeEquals). - Database-unlock gate — a locked or encrypted database refuses every request.
- Process whitelist — the first connection from any client process requires explicit approval.
- Separate delete permission — deletion is its own opt-in toggle.
- Sensitive-field redaction — password/key/token fields return as
****, are excluded from search, and are protected against relabeling-based extraction. - Architecture —
NovaraMCP.exeis a zero-logic stdio frontend; all data access happens inside the running Novara process.
The core principle — Novara itself never transmits your data — is preserved. See the Privacy Policy for the data boundary when a cloud-hosted AI client is connected.
11. Future changes
Security hardening continues across releases. Future updates may add further controls to the MCP interface (e.g. scoped tool permissions); each release's changelog will list security-relevant changes.
12. Contact
- Email: owner@novara.xin
- GitHub: https://github.com/Novara-owner/Novara-Vault
安全说明
本文档有两个用途：(1) 告诉安全研究人员如何私下报告漏洞；(2) 向用户说明 Novara 如何保护你的数据、以及不保护什么。
1. 受支持的版本
以下版本提供安全修复。我们强烈建议始终运行最新版本。
| 版本 | 状态 | 说明 |
|---|---|---|
| 5.0 | ✅ 支持 | 当前版本 |
| 4.0 | ✅ 支持 | 在可行范围内提供关键修复 |
| 3.0 | ✅ 支持 | 在可行范围内提供关键修复 |
| 2.0 | ⚠️ 旧版 | 使用较旧的 AES-CBC 加密；建议升级 |
| < 2.0 | ❌ 不支持 |
2. 报告漏洞
我们认真对待安全报告，且绝不惩罚善意的安全研究。
请先私下报告——不要在公开 Issue 中贴出漏洞细节。
- 首选：GitHub → Security 标签 → Report a vulnerability（私密漏洞上报）。
- 备选：发送邮件至 owner@novara.xin，标题以
[Security] ...开头。
请尽量包含：
- 受影响的版本；
- 对问题及其潜在影响的清晰描述；
- 复现步骤（或概念验证），如有；
- 建议的修复方案（可选）。
你可以期待：
- 我们力争在 5 个工作日内确认收到你的报告。
- 我们会持续告知你评估与修复进展。
- 高危漏洞在修复发布前不会公开披露。
- 致谢：我们乐于在发布说明中致谢报告者，除非你要求匿名。
3. 安全模型与威胁模型
我们保护什么。 Novara 是一款 本地优先 应用，其安全目标是保护静止数据（磁盘上的单文件数据库），使其免于：
- 在应用锁定或关闭时被随意或未经授权地读取（通过可选加密）；
- 加密文件被静默篡改（通过 AES-GCM 认证）；
- 意外数据丢失（通过原子写入、回收站与本地备份）；
- 锁屏密码被暴力猜解（通过锁定机制与单调时钟）。
我们不保护什么（诚实的边界）。 本地应用无法抵御一切。Novara 不抵御：
- 已解锁的会话——能操作你电脑的人能看到你所看到的内容。
- 你电脑上的恶意软件——键盘记录、屏幕录制、远程木马，或已被攻陷的 Windows 账户。
- 物理接触——能物理接触你已解锁设备的人。
- 丢失/遗忘密码——设计上无恢复机制。
- 内存提取——应用解锁期间加密密钥驻留内存。
结论： Novara 的加密保护的是磁盘上的静止数据。它不能替代一台健康、无恶意软件、物理环境安全的电脑。
4. 加密体系
开启隐私锁后，Novara 对整个数据库加密：
| 项目 | 详情 |
|---|---|
| 加密算法 | AES-256-GCM（认证加密），256 位密钥 |
| 密钥派生 | PBKDF2-SHA256，100,000 次迭代，每用户随机 32 字节盐 |
| 密码 | 6–64 位字符；本地仅存加盐 SHA-256 哈希 |
| 认证 | 12 字节随机 nonce + 16 字节 GCM tag——任何篡改都会被检出 |
| 数据流 | JSON → GZip 压缩 → AES 加密 → 落盘文件 |
| 迁移 | 旧版 v1（AES-CBC，Novara 2.0）在一次确认后自动迁移到 v2（GCM） |
重要：加密默认关闭。未开启隐私锁时，数据库是明文 JSON 文件（仅受 Windows 账户权限保护）。这是刻意的设计选择，避免普通用户被自己的数据锁在门外。
5. 数据完整性与可靠性
- 原子写入——每次保存先写临时文件、刷盘、再原子替换原文件。
- 单写者纪律——去抖/串行化的保存队列 + 单实例互斥。
- 独占文件锁 + Hidden/ReadOnly 属性——降低第三方软件误改的概率。
- 回收站（软删除）——删除的卡片 7 天内可恢复。
- 本地滚动备份——最多 10 份可恢复的本地快照。
- 崩溃日志（本地、脱敏）——敏感值（如 API Key）已脱敏，绝不自动上传。
- 完整性校验——导出格式带 16 字节 MD5 头；导入经校验、归一化，失败即回滚。
6. 防暴力破解与锁定
- 连续 5 次输错密码后，锁定 30 分钟。
- 失败次数与锁定截止时间跨重启持久化（
lockout.dat）。 - 锁定使用单调时钟（
Environment.TickCount64），防止回拨系统时间绕过。 - 锁屏在窗口失焦时清空输入框。
7. 版本兼容与降级警告
| 场景 | 行为 |
|---|---|
| 在 3.0/4.0/5.0 中打开 2.0 数据 | ✅ 可读，并在一次确认后从 AES-CBC（v1）迁移到 AES-GCM（v2） |
| 在 2.0 中打开 3.0/4.0/5.0 数据 | ❌ 无法读取——2.0 不识别 GCM 格式 |
| 3.0 ↔ 4.0 ↔ 5.0 | ✅ 同为 v2 GCM 格式，兼容 |
⚠️ 降级或回滚到 2.0 之前，请先导出一份明文备份。数据库一旦迁移到 GCM，旧版本将无法打开。
8. 应用加固
- 编辑器 XSS 防护——富文本 HTML 在加载、保存与导航后均经严格白名单净化（AngleSharp）。脚本标签、
on*属性、危险协议均被剥离，标题以纯文本渲染。 - 不执行不可信输入——导入的 HTML 与 JSON 只解析与归一化，绝不执行。
- 仅本地的辅助进程——桌面便签辅助进程通过本机文件与命名事件通信，不产生网络请求，不开放监听端口。
- 最小攻击面——不监听网络端口、无 HTTP 服务器。唯一出站网络调用是用户触发的 API Key 检测。MCP 服务器只是本地命名管道端点。
9. 开发者承诺
- 绝不运营收集用户数据的云服务器。
- 绝不加入后门、密码找回绕过机制，或任何远程解锁/窃取数据的途径。
- 绝不加入遥测、分析或广告。
- 绝不在未经用户显式操作的情况下自动更新或自动上传数据。
- 透明披露安全问题：先修复、后发布，并致谢报告者。
10. MCP 接口安全模型
可选 MCP 接口让 AI 助手读写卡片。其安全模型采用纵深防御：
- 默认关闭——需你在设置页开启并复制令牌。
- 令牌鉴权——每用户令牌，固定时间比较（
CryptographicOperations.FixedTimeEquals）。 - 数据库解锁门控——锁着或加密的数据库会拒绝一切请求。
- 进程白名单——任何客户端进程首次连接都需显式授权。
- 删除独立权限——删除操作单独一个开关。
- 敏感字段脱敏——密码/密钥/token 字段返回为
****，不参与搜索，并防止改名绕过脱敏。 - 架构——
NovaraMCP.exe是零逻辑 stdio 前端，所有数据访问都发生在运行中的 Novara 主进程内。
核心原则——Novara 自身绝不传输你的数据——保持不变。接入云端 AI 客户端时的数据边界，见隐私政策。
11. 未来变更
安全加固会跨版本持续推进。未来可能为 MCP 接口加入更细粒度的工具权限控制等，每版更新日志都会列出安全相关变更。