Security Policy
Obveto is a local, on-device meeting notetaker: recordings, transcripts and notes stay on the user’s computer. A security flaw in it could expose exactly the material it exists to protect, so we treat reports as a priority and welcome them from anyone.
1. Reporting a vulnerability
Email hello@obveto.com with “Security” in the subject. Please include:
- the Obveto version and operating system (Settings → About shows the version);
- what an attacker can do, and what they need first (local access, a crafted audio or model file, a network position…);
- steps or a proof of concept that reproduce it.
Please do not include real meeting recordings or anyone’s personal data — a synthetic file that triggers the issue is enough. Please do not disclose the issue publicly before a fix is available.
Machine-readable contact details are in /.well-known/security.txt (RFC 9116).
2. What happens next
- We acknowledge a report within 3 business days.
- We confirm or rule out the issue and tell you our assessment and the expected fix timeline.
- We fix confirmed issues in a new release and credit you in the release notes, unless you prefer to stay anonymous.
- We ask for up to 90 days before public disclosure, and we will coordinate the date with you.
We will not pursue legal action against good-faith research that stays on your own machine and data, avoids harm to others, and gives us a reasonable chance to fix the issue before disclosure.
3. Scope
- In scope: the Obveto desktop application for Windows and macOS (including its update mechanism and the files it downloads), license-key verification, and the obveto.com website.
- Also welcome: vulnerabilities in the open-source components Obveto ships (listed in the SBOM below) that are reachable through Obveto — we will coordinate with the upstream project.
- Out of scope: issues that require an attacker who already controls the user’s account or operating system, and denial-of-service against the website.
4. Supported versions
Security fixes ship in the latest release. Obveto updates in place (Settings → General → Updates), and installers are always available from the latest release. If you run an older version, update before reporting.
5. Software bill of materials
Every release publishes CycloneDX SBOMs next to its installers, one set per platform (the component list differs between Windows and macOS):
- Application (Rust crates, plus the bundled FFmpeg): Windows x64 · macOS Apple Silicon · macOS Intel
- Summarization helper: Windows x64 · macOS Apple Silicon · macOS Intel
- User interface (JavaScript packages, all platforms): Obveto-sbom-ui.cdx.json
Native libraries that Rust crates build or bundle (whisper.cpp, llama.cpp, sherpa-onnx with ONNX Runtime) appear under the crates that carry them.
6. Security advisories
When a vulnerability affecting Obveto is being actively exploited, or a fix addresses a serious issue, we say so in the release notes of the fixing version and on this website, with what to do. Where the EU Cyber Resilience Act applies, we also notify the competent authorities through ENISA’s Single Reporting Platform within the deadlines it sets.