Please do not open a public issue for a security problem.

Use GitHub's private vulnerability reporting on this repository, or email ritvikr98@gmail.com with FeatherWall security in the subject.

This is a small project maintained by one person in their spare time, so treat these as best effort rather than a guarantee: expect a first reply within about a week. If you have not heard back in two weeks, feel free to chase it.

Only the latest release and the current main branch receive fixes. There are no long-term support branches.

FeatherWall runs as a normal desktop application under your own account, and it deliberately never runs elevated. The interesting attack surface is small but real:

• Gallery downloads. FeatherWall fetches media over HTTPS from URLs listed in src/FeatherWall/Gallery/gallery.json. Eight of the eleven entries are pinned to a SHA-1 that is verified after download. Three NASA-hosted videos are currently unpinned, which is tracked as a known gap. Anything that lets a manifest entry write outside the cache directory, or that bypasses checksum verification where a checksum exists, is in scope.
• Config parsing. %APPDATA%\FeatherWall\config.json is read at startup. Crashes are bugs; anything that turns a config file into code execution is a vulnerability.
• Media decoding. Decoding runs through the operating system's Media Foundation pipeline. Bugs in the codecs themselves belong to Microsoft, but if FeatherWall hands the pipeline something it should not, that is ours.
• Window handling. FeatherWall reparents a window into the shell's wallpaper layer. Anything that lets another process abuse that to draw over or read from the desktop is in scope.

• SmartScreen warnings on unsigned builds. Releases are unsigned today and the README says so. Code signing is on the roadmap.
• Requiring the user to already have local code execution or administrator rights.
• Denial of service that amounts to "a corrupt video file makes the wallpaper stop."

Report privately, give it a reasonable window to be fixed, and credit is yours in the release notes unless you would rather stay anonymous.