The following versions of CommDesk are currently supported with security updates:

We recommend always using the latest release for security fixes and improvements.

If you discover a security vulnerability, please report it responsibly.

• Email: security@nexgenstudio.dev
• Or open a private security advisory via GitHub:
  • Go to the repository
  • Click Security → Advisories → Report a vulnerability

• Open public issues for security vulnerabilities
• Share exploits publicly before disclosure

To help us respond quickly, include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Screenshots or proof-of-concept (if applicable)
• Suggested fix (optional but appreciated)

We aim to resolve critical issues as quickly as possible.

CommDesk follows these security practices:

• Role-based access control (RBAC)
• Strict frontend-backend boundary enforcement
• Input validation and sanitization
• Dependency auditing (via pnpm audit)
• Signed desktop updates using Tauri updater
• Secure key handling (~/.tauri/commdesk.key)

• All production releases should be signed
• Auto-updates must use verified signatures
• Do not distribute unsigned binaries in production

We appreciate responsible disclosure and will:

• Credit researchers (if desired)
• Work collaboratively on fixes
• Keep communication transparent

This project is under active development. While we strive for strong security practices, users should:

• Avoid using in high-risk production environments without audit
• Regularly update to latest versions

We thank the open-source community and contributors for helping improve the security of CommDesk.