# Security policy

This app runs on a car. It reads vehicle data and holds credentials for a third-party
service, so security reports are welcome and taken seriously.

## Reporting a vulnerability

Please **do not** open a public issue for a vulnerability. Use GitHub's
[private vulnerability reporting](../../security/advisories/new) instead.

Include what you were able to do, on which firmware generation, and whether the vehicle
was moving. A proof of concept helps; a working exploit is not required.

## What is in scope

- Anything that lets another app on the head unit read the stored ABRP credentials.
- Anything that gets attacker-controlled code installed through the unstable updater.
- Anything that makes the app write to the vehicle. **It should never write at all** — this
  app is read-only towards the car — so any write path is a bug by definition.
- Telemetry that leaks credentials into logs, URLs or crash reports.

## What is not in scope

- Requiring physical access to an unlocked head unit with developer mode enabled.
- The stable channel not auto-updating. That is deliberate; see `LICENSE.md` and the
  README's channel table.
- Vulnerabilities in the OEM firmware itself. Report those to SAIC.

## Design decisions you should know about

- Credentials live in `EncryptedSharedPreferences` and are sent in a POST body, never a
  URL. `allowBackup` is off and both preference files are excluded from backup rules.
- The unstable updater accepts an APK only over https, only from an exact-match GitHub host
  allowlist, and only when its signing certificate matches the running app's. All three
  checks fail closed. The stable channel does not contain the updater at all.
- The VHAL probe helpers, which enumerate the whole vehicle abstraction layer, exist only
  in debug builds.