Electron isolation
Renderer code uses context isolation, no Node integration, a narrow preload API, and a restrictive content security policy.
Protection model
Every sensitive action has a boundary.
Permission gates sharing. Process isolation narrows access. Stop controls remain available. Public records contain aggregate activity, never device identifiers.
Consent boundary
The sharing service starts only after an affirmative interface action. Opt-out disconnects the sharing session.
Stop path
The main window, settings, tray, process quit, and incident controls provide distinct ways to end activity.
Data minimization
Public records use aggregate values. Device or node identifiers never belong in unauthenticated responses.
Public by design
Cloudfunding is open source. Anyone can inspect the code, review security changes, and confirm that the implementation matches the controls described here.
Independent verification
Public code gives developers and security researchers a direct way to review boundaries, follow changes, and strengthen the system.
Isolated interface
The user interface cannot import Node modules or reach arbitrary operating-system APIs. It can request only defined Cloudfunding operations through the isolated preload bridge.
Validated commands
The main process owns sharing initialization, preference storage, tray behavior, and external navigation. Every exposed command validates its input and returns structured state.
Restricted content
A strict content security policy limits scripts and images to approved sources. External navigation is handled by the operating system instead of loading untrusted pages inside the app.
Immediate stop controls
The main window, settings, tray, and process quit controls all provide direct ways to end sharing.
Provider-confirmed revenue
Request counts show activity. Provider settlement records establish revenue. The two values are never presented as if they were the same.
Traceable decisions
Allocation and disbursement records carry their source period, policy version, adjustments, approvals, project status, and timestamps.
Protected payout changes
The accounting model protects destination changes with strong authentication, independent confirmation, review thresholds, and alerts to existing contacts.
Visible checks
The accounting model keeps reconciliation differences, unusual activity, identity changes, and payout changes visible for review before funds move.
Private advisories
GitHub private security advisories keep sensitive reports out of public issue threads while they are reviewed and resolved.
Useful reports
Include the affected component and version, prerequisites, reproduction steps, realistic impact, and any suggested mitigation.
Coordinated resolution
The private workflow keeps technical details contained while a fix is prepared and responsible disclosure is coordinated.