From 73b3eb620755289823fb9449e817afa023b9c030 Mon Sep 17 00:00:00 2001 From: Guyiome Date: Thu, 20 Aug 2026 19:02:11 +0200 Subject: [PATCH 1/2] Add SECURITY.md (EN/FR/JA/ZH) Points to GitHub's private vulnerability reporting (enabled on the repo alongside secret scanning + push protection, all free on a public repo) instead of a personal email, since there's no team/ infra to route reports to. Scope section is upfront about this being a local-network-only app -- exploiting anything here needs an attacker already on the same Wi-Fi -- and points at the specific network/logging files most relevant to a review. JA/ZH carry the same unreviewed-machine-translation disclaimer as the other translated docs; EN/FR are the authoritative pair. Linked from README.md/README_FR.md next to the existing Contributing section (JA/ZH READMEs left as-is for now). --- README.md | 5 +++++ README_FR.md | 5 +++++ docs/SECURITY.md | 33 +++++++++++++++++++++++++++++++++ docs/SECURITY_FR.md | 36 ++++++++++++++++++++++++++++++++++++ docs/SECURITY_JA.md | 38 ++++++++++++++++++++++++++++++++++++++ docs/SECURITY_ZH.md | 35 +++++++++++++++++++++++++++++++++++ 6 files changed, 152 insertions(+) create mode 100644 docs/SECURITY.md create mode 100644 docs/SECURITY_FR.md create mode 100644 docs/SECURITY_JA.md create mode 100644 docs/SECURITY_ZH.md diff --git a/README.md b/README.md index 1b098ef..743ec88 100644 --- a/README.md +++ b/README.md @@ -153,6 +153,11 @@ competing product. See `docs/CONTRIBUTING.md` before opening a pull request -- any contribution implies acceptance of the contributor license agreement (`docs/CLA.md`). +## Security + +Found a vulnerability? See `docs/SECURITY.md` -- please report it privately rather than as a +public issue. + ## Publishing a release (maintainer) Signing configured via environment variables (`RELEASE_KEYSTORE_BASE64`, diff --git a/README_FR.md b/README_FR.md index 34168e4..7388b77 100644 --- a/README_FR.md +++ b/README_FR.md @@ -161,6 +161,11 @@ mais pas librement redistribuable comme produit concurrent. Voir `docs/CONTRIBUTING_FR.md` avant d'ouvrir une pull request -- toute contribution suppose l'acceptation de l'accord de licence contributeur (`docs/CLA_FR.md`). +## Sécurité + +Trouvé une faille ? Voir `docs/SECURITY_FR.md` -- merci de la signaler en privé plutôt que via une +issue publique. + ## Publier une version (mainteneur) Signature configurée via des variables d'environnement (`RELEASE_KEYSTORE_BASE64`, diff --git a/docs/SECURITY.md b/docs/SECURITY.md new file mode 100644 index 0000000..d2add3a --- /dev/null +++ b/docs/SECURITY.md @@ -0,0 +1,33 @@ +# Security Policy + +*🇫🇷 Français : [SECURITY_FR.md](SECURITY_FR.md) · 🇨🇳 简体中文: [SECURITY_ZH.md](SECURITY_ZH.md) · 🇯🇵 日本語: [SECURITY_JA.md](SECURITY_JA.md)* + +## Reporting a vulnerability + +Please report security vulnerabilities privately through GitHub's +[private vulnerability reporting](https://github.com/guyiome/AndroidMoCap/security/advisories/new) +(Security tab → "Report a vulnerability"), not as a public issue. + +This project is maintained by one person — expect a best-effort response, not a formal SLA. I'll +acknowledge reports as soon as I can and keep you updated while a fix is worked on. + +## Scope + +AndroidMoCap only communicates on the local network the phone is connected to (Wi-Fi). It never +talks to a remote server, and the app itself never initiates an outbound connection beyond an +optional GitHub Releases check for updates. Keep that in mind when assessing severity: exploiting +a network-facing issue here requires an attacker already present on the same local network. + +Areas most relevant to a security review: + +- `network/IFacialMocapSender.kt` — passive UDP listener (iFacialMocap/VBridger wire protocol), + unauthenticated by design, matching the third-party protocol it implements. +- `network/VTubeStudioSender.kt` / `VTubeStudioProtocol.kt` — WebSocket client with a token-based + auth handshake against VTube Studio's own Plugin API. +- `network/VmcOscSender.kt` — outbound-only OSC/UDP, no listening socket. +- `logging/AppLog.kt` / `LogFormatting.kt` — local log file; IP addresses are masked outside debug + builds, and no face-tracking data is ever logged above `DEBUG` level. + +## Supported versions + +Only the latest published release is supported — there is no long-term maintenance branch. diff --git a/docs/SECURITY_FR.md b/docs/SECURITY_FR.md new file mode 100644 index 0000000..17fc70a --- /dev/null +++ b/docs/SECURITY_FR.md @@ -0,0 +1,36 @@ +# Politique de sécurité + +*🇬🇧 English: [SECURITY.md](SECURITY.md) · 🇨🇳 简体中文: [SECURITY_ZH.md](SECURITY_ZH.md) · 🇯🇵 日本語: [SECURITY_JA.md](SECURITY_JA.md)* + +## Signaler une faille + +Merci de signaler toute faille de sécurité en privé via la fonctionnalité GitHub de +[signalement privé de vulnérabilité](https://github.com/guyiome/AndroidMoCap/security/advisories/new) +(onglet Security → "Report a vulnerability"), et non via une issue publique. + +Ce projet est maintenu par une seule personne — la réponse se fait au mieux, sans SLA formel. +J'accuserai réception dès que possible et tiendrai informé pendant la résolution. + +## Portée + +AndroidMoCap ne communique que sur le réseau local (Wi-Fi) auquel le téléphone est connecté. Il ne +parle jamais à un serveur distant, et l'app elle-même n'initie jamais de connexion sortante en +dehors d'une vérification optionnelle des Releases GitHub pour les mises à jour. À garder en tête +pour évaluer la sévérité : exploiter un problème réseau ici suppose un attaquant déjà présent sur +le même réseau local. + +Zones les plus pertinentes pour une revue de sécurité : + +- `network/IFacialMocapSender.kt` — écoute UDP passive (protocole iFacialMocap/VBridger), sans + authentification par conception, conformément au protocole tiers qu'il implémente. +- `network/VTubeStudioSender.kt` / `VTubeStudioProtocol.kt` — client WebSocket avec une poignée de + main d'authentification par token contre l'API Plugin propre à VTube Studio. +- `network/VmcOscSender.kt` — OSC/UDP sortant uniquement, aucun socket d'écoute. +- `logging/AppLog.kt` / `LogFormatting.kt` — fichier de log local ; les adresses IP sont masquées + hors build de développement, et aucune donnée de suivi du visage n'est jamais journalisée + au-dessus du niveau `DEBUG`. + +## Versions supportées + +Seule la dernière version publiée est supportée — il n'y a pas de branche de maintenance long +terme. diff --git a/docs/SECURITY_JA.md b/docs/SECURITY_JA.md new file mode 100644 index 0000000..51be892 --- /dev/null +++ b/docs/SECURITY_JA.md @@ -0,0 +1,38 @@ +# セキュリティポリシー + +*🇬🇧 English: [SECURITY.md](SECURITY.md) · 🇫🇷 Français : [SECURITY_FR.md](SECURITY_FR.md) · 🇨🇳 简体中文: [SECURITY_ZH.md](SECURITY_ZH.md)* + +> ⚠️ **機械翻訳について**：このドキュメントはAIによる自動翻訳であり、人間やネイティブスピーカーに +> よる校正は行われていません。参考情報としてのみご利用ください。法的効力を持つのは英語原文 +> [SECURITY.md](SECURITY.md) です。 + +## 脆弱性の報告について + +セキュリティ上の脆弱性は、公開の issue としてではなく、GitHub の +[プライベート脆弱性報告](https://github.com/guyiome/AndroidMoCap/security/advisories/new) +（Security タブ → "Report a vulnerability"）を通じて非公開で報告してください。 + +本プロジェクトは一人のメンテナーによって管理されています——ベストエフォートでの対応となり、正式な +SLA はありません。可能な限り速やかに受領を確認し、修正の進捗をお伝えします。 + +## 対象範囲 + +AndroidMoCap は、スマートフォンが接続しているローカルネットワーク（Wi-Fi）上でのみ通信します。 +リモートサーバーと通信することは一切なく、アプリ自体がアウトバウンド接続を開始することも、更新確認 +のための GitHub Releases への任意アクセスを除いてありません。深刻度を評価する際はこの点にご留意 +ください：ここでのネットワーク関連の問題を悪用するには、攻撃者が同じローカルネットワーク上に既に +存在している必要があります。 + +セキュリティレビューにおいて特に関連性の高い箇所： + +- `network/IFacialMocapSender.kt` —— パッシブな UDP リスナー（iFacialMocap/VBridger のワイヤー + プロトコル）。実装元のサードパーティプロトコルに合わせ、設計上認証なし。 +- `network/VTubeStudioSender.kt` / `VTubeStudioProtocol.kt` —— VTube Studio 自身の Plugin API に + 対する、トークンベースの認証ハンドシェイクを伴う WebSocket クライアント。 +- `network/VmcOscSender.kt` —— アウトバウンドのみの OSC/UDP、リスニングソケットなし。 +- `logging/AppLog.kt` / `LogFormatting.kt` —— ローカルのログファイル。IP アドレスはデバッグビルド + 以外ではマスクされ、`DEBUG` レベルより上で顔トラッキングデータがログに記録されることはありません。 + +## サポート対象バージョン + +サポートされるのは最新の公開リリースのみです——長期メンテナンスブランチはありません。 diff --git a/docs/SECURITY_ZH.md b/docs/SECURITY_ZH.md new file mode 100644 index 0000000..47bcf64 --- /dev/null +++ b/docs/SECURITY_ZH.md @@ -0,0 +1,35 @@ +# 安全政策 + +*🇬🇧 English: [SECURITY.md](SECURITY.md) · 🇫🇷 Français : [SECURITY_FR.md](SECURITY_FR.md) · 🇯🇵 日本語: [SECURITY_JA.md](SECURITY_JA.md)* + +> ⚠️ **机器翻译声明**：本文档由 AI 自动翻译生成，尚未经过人工或母语者校对，仅供参考。具有法律效力的 +> 版本是英文原版 [SECURITY.md](SECURITY.md)。 + +## 报告漏洞 + +请通过 GitHub 的 +[私密漏洞报告](https://github.com/guyiome/AndroidMoCap/security/advisories/new) +功能（Security 标签页 → "Report a vulnerability"）私下报告安全漏洞，而不要提交公开 issue。 + +本项目由一人独立维护——响应为尽力而为，没有正式的 SLA。我会尽快确认收到报告，并在修复过程中及时 +告知进展。 + +## 范围 + +AndroidMoCap 仅在手机所连接的本地网络（Wi-Fi）上通信。它从不与远程服务器通信，应用本身也从不主动 +发起出站连接，唯一的例外是可选的 GitHub Releases 更新检查。评估严重程度时请留意这一点：利用此处 +的网络相关问题需要攻击者已经处于同一本地网络中。 + +与安全审查最相关的部分： + +- `network/IFacialMocapSender.kt` —— 被动 UDP 监听器（iFacialMocap/VBridger 线协议），按设计不带 + 身份验证，与其实现的第三方协议保持一致。 +- `network/VTubeStudioSender.kt` / `VTubeStudioProtocol.kt` —— 针对 VTube Studio 自身 Plugin API + 的 WebSocket 客户端，带有基于令牌的身份验证握手。 +- `network/VmcOscSender.kt` —— 仅出站的 OSC/UDP，无监听套接字。 +- `logging/AppLog.kt` / `LogFormatting.kt` —— 本地日志文件；IP 地址在非调试构建中会被掩码处理， + 且面部追踪数据从不会以高于 `DEBUG` 的级别被记录。 + +## 支持的版本 + +仅支持最新发布的版本——没有长期维护分支。 From 759d6daa535e3ebc75d3b721c6570dd4f8817254 Mon Sep 17 00:00:00 2001 From: Guyiome Date: Thu, 20 Aug 2026 19:02:53 +0200 Subject: [PATCH 2/2] Add issue and PR templates Bug report form asks for device/Android version/tracking tier/network target upfront (behavior here is highly device- and config-dependent) and points at the in-app log export instead of relying on memory. Feature request form reminds contributors of the discuss-before-PR convention from CONTRIBUTING.md. config.yml disables blank issues and redirects security reports to private vulnerability reporting instead. PR template checks CLA agreement, real-device testing, and the revue-technique sync convention. --- .github/ISSUE_TEMPLATE/bug_report.yml | 77 ++++++++++++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 5 ++ .github/ISSUE_TEMPLATE/feature_request.yml | 22 +++++++ .github/PULL_REQUEST_TEMPLATE.md | 11 ++++ 4 files changed, 115 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml create mode 100644 .github/PULL_REQUEST_TEMPLATE.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..a521085 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,77 @@ +name: Bug report +description: Something doesn't work as expected +labels: ["bug"] +body: + - type: markdown + attributes: + value: | + Thanks for taking the time to report this. Tracking behavior can vary a lot by device and + configuration, so the fields below help narrow it down quickly. + + - type: input + id: device + attributes: + label: Phone model + placeholder: e.g. Pixel 8, Samsung Galaxy S23 + validations: + required: true + + - type: input + id: android-version + attributes: + label: Android version + validations: + required: true + + - type: dropdown + id: tier + attributes: + label: Tracking tier (Settings > Advanced > Diagnostics) + options: + - COMPATIBLE + - STANDARD + - OPTIMAL + - Not sure + validations: + required: true + + - type: dropdown + id: target + attributes: + label: Network target + options: + - Blender/Unity (VMC/OSC) + - VBridger (UDP) + - VTube Studio (Plugin API) + - Not applicable + validations: + required: true + + - type: textarea + id: repro + attributes: + label: Steps to reproduce + validations: + required: true + + - type: textarea + id: expected + attributes: + label: Expected behavior + + - type: textarea + id: logs + attributes: + label: Logs + description: > + Export logs from Settings > Advanced > Logging and attach the file here (drag & drop) -- + more reliable than describing behavior from memory. IP addresses are masked automatically + outside debug builds, no face-tracking data is ever logged. + + - type: checkboxes + id: security-confirmation + attributes: + label: Confirmation + options: + - label: This is not a security vulnerability report (those go through [private reporting](https://github.com/guyiome/AndroidMoCap/security/advisories/new) instead) + required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..37157f3 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: false +contact_links: + - name: Report a security vulnerability + url: https://github.com/guyiome/AndroidMoCap/security/advisories/new + about: Please do not report security vulnerabilities as public issues -- use GitHub's private reporting instead (see docs/SECURITY.md). diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..4d0f619 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,22 @@ +name: Feature request +description: Suggest an idea for this project +labels: ["enhancement"] +body: + - type: textarea + id: problem + attributes: + label: What problem would this solve? + validations: + required: true + + - type: textarea + id: solution + attributes: + label: Proposed solution + + - type: markdown + attributes: + value: | + Per `docs/CONTRIBUTING.md`, please open this issue before working on a pull request for + anything non-trivial -- this project is maintained by one person, and an upfront + discussion avoids duplicated work on either side. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..665a627 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,11 @@ +## Summary + + + +## Checklist + +- [ ] I agree to the terms of the project's [CLA](../docs/CLA.md) -- required for any contribution +- [ ] Tested on a real device (required for anything touching camera/tracking -- the emulator has + no usable camera feed) +- [ ] Updated `AndroidMoCap_revue_technique.md` / the relevant spec doc, if this touches something + already tracked there