CoPanda handles your clipboard history—that can include sensitive stuff. I take security seriously because you're trusting this tool with content that might be personal or confidential.

This isn't corporate security theater. This is a personal project shared with the community. It's built on trust—transparency in the code, responsibility when issues come up, and treating security researchers as partners.

I'm not protecting a brand or business. I'm protecting you and everyone using this tool.

• 100% Local Storage — Your clipboard history never leaves your machine. No cloud sync, no telemetry, no remote servers.
• Sensitive Data Exclusion — Content the source app marks as secret or concealed is never read, so it never reaches the history. Most password managers (1Password, Bitwarden, etc.) mark what they copy; content without that mark is stored like any other copy.
• No Tracking — I don't collect anything. No analytics, no usage data, nothing.

• Local SQLite Database — Your clipboard history is stored in a local database on your machine, not in the cloud.
• Configurable Retention — Automatically delete old clipboard items based on your retention settings.
• Open Source — Every line of code is public. You can inspect, audit, and verify what we're doing.
• Signed Updates — Every installer the updater offers is signed with minisign, and the public key is compiled into the application. The signature is checked before anything is installed, so a compromised mirror cannot hand you a different binary: an update that does not verify is refused rather than installed. Each signature is bound to its exact version, so an older release cannot be served under a newer number, and the download address is checked against this repository's releases before a single byte is downloaded.
• Nothing That Locks You Out — CoPanda never blocks a version you already have. An update is an offer; your history is yours and stays reachable whether you take it or not.

• Written in Rust — One workspace, with unsafe confined to the two crates that talk to the operating system and denied everywhere else by the compiler.
• Dependencies Audited on Every Change — cargo-deny checks advisories and licences in CI, and the build fails on a warning.
• Dependency Updates — We regularly update dependencies to patch known vulnerabilities.
• Code Reviews — All contributions go through review before merging.

Security updates are provided for:

We strongly recommend always using the latest version from the Releases Page.

If you discover a security vulnerability in CoPanda, please help us protect our users by reporting it responsibly.

Please report:

• ✅ Unauthorized access to clipboard history
• ✅ Privilege escalation issues
• ✅ Data leakage or unintended storage of sensitive information
• ✅ Injection attacks (SQL, command, etc.)
• ✅ Bypass of sensitive data exclusion mechanisms
• ✅ Critical bugs that could lead to data loss or corruption

Not security issues:

• ❌ Feature requests or enhancements
• ❌ General bugs that don't have security implications
• ❌ Issues with third-party dependencies (report those upstream)
• ❌ Windows SmartScreen warnings (see README for explanation)

DO NOT open a public GitHub issue for security vulnerabilities. Instead, use one of these private channels:

Send an email to: github@apirest.cl

Subject: [SECURITY] Brief description of the issue

This is the fastest way to reach us. We check email daily and will respond within 48 hours.

1. Go to the Security tab in the repository
2. Click "Report a vulnerability"
3. Fill in the details using the template provided
4. Submit privately — only maintainers will see it

Choose whichever method is most comfortable for you. What matters is that we hear from you.

Include in your report:

• Description — Clear explanation of the vulnerability
• Impact — What could an attacker do? Who is affected?
• Steps to Reproduce — How can we reproduce the issue?
• CoPanda Version — Which version is affected?
• OS and version — e.g., Windows 11 23H2, macOS Sequoia 15.1
• Proof of Concept (optional) — Code or screenshots demonstrating the issue
• Suggested Fix (optional) — If you have ideas on how to fix it

1. Acknowledgment (Within 48 Hours)

   • I'll confirm I received your report
   • I'll let you know if I need more information

2. Investigation (1-7 Days)

   • I'll reproduce and analyze the issue
   • Assess severity and impact
   • Develop a fix

3. Resolution

   • Create a patch and test it thoroughly
   • Coordinate a release timeline with you
   • Credit you in the release notes (if you want)

4. Disclosure (After Fix is Released)

   • Publish a security advisory
   • Notify users to update
   • You can publicly disclose (coordinated disclosure)

I'm one person (with community help), but I take security seriously. If you don't hear back within the expected timeframe, please follow up—things might've gotten lost.

I believe in coordinated disclosure to protect users:

• Please give me reasonable time to fix the issue before publicly disclosing it
• I aim to release fixes within 7 days for critical issues
• I'll work with you on a disclosure timeline that protects users
• I'll credit you in the release notes (unless you prefer to remain anonymous)

I WILL:

• ✅ Treat you with respect and gratitude—you're helping protect users
• ✅ Respond promptly to your report (within 48 hours)
• ✅ Keep you updated throughout the investigation and fix process
• ✅ Credit your work publicly (if you want)
• ✅ Be transparent about the timeline and progress

I will NEVER:

• ❌ Threaten legal action against good-faith security researchers
• ❌ Ignore or dismiss legitimate reports
• ❌ Retaliate against reporters in any way
• ❌ Use intimidation tactics or silence critics
• ❌ Blame you for finding vulnerabilities in the code

Security research makes everyone safer. I'm grateful for your work and will treat you as a valued partner in protecting the community.

We're grateful to the security researchers who help make CoPanda safer:

• No security issues reported yet. Help us stay secure!

Want to be listed here? Report a verified security vulnerability and choose to be credited. We'll add your name (or handle) and a link to your profile if you'd like.

• Keep CoPanda Updated — Nothing updates automatically: Settings → About offers a new version and installs it when you press Update. The Microsoft Store copy updates through the Store; a Homebrew copy updates itself with the same button
• Review Clipboard History — Periodically check what's being stored and delete sensitive items
• Configure Retention — Set shorter retention periods if you handle highly sensitive data
• Use Password Managers — Most mark what they copy as secret, and CoPanda never reads content marked that way. Check yours once: copy a credential and make sure no entry appears

• Read the Code — The entire codebase is open source: CoPanda Repository
• Review Dependencies — Every package and crate that ships is listed in THIRD-PARTY-BUNDLED.md, with its licence text in THIRD-PARTY-LICENSES.md
• Security Best Practices — Follow secure coding guidelines when contributing

CoPanda does not currently use cryptographic functions for data storage.

• Clipboard history is stored in plaintext in a local SQLite database
• Database files are protected by OS-level file system permissions (Windows and macOS)
• No encryption is applied to stored clipboard data

Why?

• The database is local-only and protected by your OS user account
• Encryption would add complexity and potential key management issues
• Performance and startup time would be impacted
• You control physical access to your machine

Future Consideration: If there's community demand for at-rest encryption, we're open to discussing it. Open an issue if this is important to you.

We're here to help and answer questions:

• Security Questions: Email us at github@apirest.cl — we're happy to discuss concerns privately
• General Questions: Open a Discussion — ask publicly, we'll answer openly
• Vulnerability Reports: Use the private channels above — never post security issues publicly
• Policy Feedback: Open an Issue — help us improve this policy

Security is everyone's responsibility. Thank you for helping keep CoPanda safe for everyone using it.

Remember: If you're unsure whether something is a security issue, reach out anyway. I'd rather have a conversation than miss a real problem.