The controls actually in the product.

Supported versions

Only the most recent public release receives security fixes.

Older release candidates are not patched. If a regression is reported against one, the answer is to upgrade.

Browser / web application

• Content Security Policy — vercel.json ships a strict CSP with default-src self, no third-party script-src,frame-ancestors none, base-uri self,object-src none. The only script-src allowances areself, wasm-unsafe-eval (Stockfish WebAssembly) andunsafe-inline (no scripts are inlined; this allowance is retained for Next.js style attributes and does not allow arbitrary inline JavaScript).
• Cross-Origin-Opener-Policy: same-origin andCross-Origin-Embedder-Policy: credentialless are sent on every response, which is what enables SharedArrayBuffer for the Stockfish multi-threaded build.
• HSTS with max-age=31536000; includeSubDomains; preload and aReferrer-Policy: strict-origin-when-cross-origin header on every response.
• Permissions-Policy disables camera, microphone,geolocation and interest-cohort (FLoC) at the document level.
• Trusted remote origins for the application's network calls are listed in connect-src: the application's own host, the GitHub Pages data mirror, Lichess, and the desktop companion's loopback range. Any other host is refused at the CSP layer.
• External link restrictions — outbound links are validated against an allow-list before the application will follow them; seesrc/middleware-host-rules.ts and src/lib/redirect-validation.ts.
• Downloaded data is verified. Every reference-pack chunk and every managed engine binary is checked against a SHA-256 recorded in the manifest before it is used; a mismatch is reported, never silently accepted. See src/reference/install.ts,src/engine/manager.ts and THIRD_PARTY_DATA.md.
• Decompression bounds — every decompression path usesDecompressionStream with an explicit byte budget and rejects a chunk whose decompressed size exceeds the manifests record.
• IndexedDB streaming cache — the explorer caches shards in IndexedDB with a byte budget and a TTL; cached bytes are re-verified against the manifest before they are reused.
• Backup portability — backups are portable JSON with the same schema-versioned envelope as persistence; see docs/deployment.md.

macOS application

• The desktop shell is Electron with contextIsolation: true,nodeIntegration: false, sandbox: true for the renderer, and a preload that exposes a typed bridge. The bridge returns null in a browser, so the same application is safe to serve over a public origin.
• The companion’s loopback server authenticates every request except /health with a pairing token the shell mints in memory on each launch and never writes to disk; the shell and the companion are the only two processes that ever hold it. Cross-origin requests are refused by CORS.
• The application is signed with a Developer ID Application certificate with the Hardened Runtime, notarised by Apple, and stapled; the build refuses to sign a bundle missing any required runtime file and launches the notarised application before it makes a disk image.
• Native engines are not sandboxed. They run with the user's own operating-system permissions, and a settings panel checkbox is the only thing that prevents them from being launched. This is documented in the Settings → Engine dialog and in AGENTS.md. Do not describe managed engines as sandboxed.
• The window cannot open a file that was not chosen in a dialog or dropped on the window; there is no readFile(path) on the bridge.
• The shell holds no chess state. A desktop feature that needs a second copy of the board, the move tree, the engine session or the query is a bug in the arrangement, not a feature of it.

What the product deliberately does not do

• No cross-device Sync. Studies, repertoire, training, notes and preferences are local to one browser profile. The documented way to move work between machines is Settings → Database → Export backup and Import on the other side.
• No telemetry, no analytics, no third-party scripts. The web build does not load Google Analytics, Plausible, Hotjar, Segment, or any equivalent. CSP would refuse them anyway.
• No advertising cookies, no advertising scripts. The web build does not set any cookie; what state the application needs is held in localStorage and IndexedDB, scoped to the origin.
• No background update. The macOS application checks for a newer release only when you choose Kingfisher → Check for Updates…, and installs one only when you click Install Update; the download is verified against the release feed and your work is saved before the application is replaced. The web build is whatever is currently deployed; if a fix is urgent, a manual refresh picks it up.

How to report a vulnerability

Do not open a public GitHub issue, discussion, tweet or forum post for a security problem. Public issues are indexed by search engines and will be read by every attacker in the world before a fix is in the next release.

Use the private GitHub Security Advisory flow:

https://github.com/mardakurt/kingfisher/security/advisories/new

If the GitHub security flow is unavailable for any reason, open a private issue at the same repository with the word SECURITY: at the start of the title andwithout exploit detail in the body — the maintainer will move the conversation to the private advisory flow.

The report should include:

• the affected version (e.g. Kingfisher 1.1 for the web build orKingfisher 1.1.2 and its build number for the macOS application);
• a minimal reproduction;
• what you observed and what you expected;
• any workarounds you tried.

A diagnostic export from Settings → Diagnostics is safe to attach. The export never includes Lichess tokens, API keys, the companion pairing token, home-directory paths or full PGN libraries.

What to expect

The maintainer aims to:

• acknowledge the report within seven days;
• ship a fix in the next release, or sooner if the issue is severe;
• publish a CVE if the report warrants one;
• credit the reporter in the release notes (unless the reporter prefers to remain anonymous).

Out of scope

• Engine binary vulnerabilities. Kingfisher verifies the SHA-256 of every engine it downloads against the manifest shipped in the repository, but the engines themselves are third-party and are covered by their own security policies.
• Reference data vulnerabilities. Kingfisher verifies the SHA-256 of every chunk it downloads against the manifest shipped in the data repository.
• Phishing, social engineering, or supply-chain attacks on the users machine.Kingfisher is local-first; the product is not a hosted service.

Non-security issues

For bugs, regressions and product questions, open an issue atthe issue tracker. Paste the Settings → Diagnostics → Copy support information line so the report includes version, machine and source/engine state.