Back to documentation

Security

Whisker Security

Security boundaries, reporting guidance, and release expectations for Whisker.

Whisker handles live audio, transcripts, translations, provider credentials, device authorization, and local model files. Security reports help protect users and the integrity of the product.

Reporting a vulnerability

Do not post an unpatched vulnerability, exploit code, private credential, or sensitive user data in a public issue.

Use the private security-reporting channel published on the official Whisker website or release repository. Before public release, the publisher should replace this sentence with the exact security email or private advisory URL.

Include, when safe to do so:

  • A concise description of the issue.
  • Affected product version or component.
  • Reproduction steps or a minimal proof of concept.
  • Security impact and likely attack conditions.
  • Any suggested mitigation.

Redact API keys, license keys, device tokens, private audio, transcripts, and personal data. If you accidentally disclose a secret, revoke or rotate it immediately and notify the relevant provider.

Scope

In scope:

  • The official Whisker Windows application and Native Host.
  • The official installer and update path.
  • The official Whisker Licensing Service.
  • Authentication, authorization, device enforcement, and signed-lease logic.
  • Handling of Cloud-provider credentials.
  • Official public release infrastructure.

Third-party provider services, operating-system vulnerabilities, and unrelated repositories should be reported to their respective owners, although context about an interaction with Whisker is still useful.

Security boundaries

  • Permanent Cloud-provider credentials remain behind the Native Host.
  • Realtime provider sessions use the appropriate temporary or session credential.
  • The licensing service stores protected representations rather than reusable raw license keys or device tokens where the service design permits.
  • The Ed25519 signing private key remains server-side.
  • Local mode does not intentionally send live audio to Cloud ASR.
  • The licensing service does not require live call content.

Release expectations

Before publishing a release, verify installer and update integrity, the expected Windows publisher identity, the absence of development secrets, correct protection of provider and licensing state, no conversation content in ordinary production logs, clean-machine installation and uninstall behavior, and that the public Privacy Policy, EULA, and Terms match actual product behavior.

Disclosure process

The publisher should acknowledge valid reports, assess severity, coordinate a fix, and communicate release guidance when appropriate. Disclosure timing may depend on exploitability, affected users, third-party coordination, and the availability of a safe fix.