中文 Download
Home Features Download Editions FAQ Contribute Security

POS / Security

Security & disclosure

A POS holds a shop’s takings and member data. Security reports are handled promptly.

1

How to report

Do not open a public issue. Use GitHub’s private vulnerability report (Security → Report a vulnerability), or email the address in the repo, with version, reproduction steps and impact.

2

Our timelines

  • First response within 48 hours — accepted or not, with a preliminary severity.
  • A fix or a documented mitigation within 30 days.
  • Details go public only after the fix ships and you agree; anonymous credit if you prefer.
3

Scope

The POS binary, local HTTP API, print service, installers and the update path are in scope. Cloud services and commercial components follow a separate process — mention it in the same channel.

How you know the build is untampered

1

Installers are code-signed; Windows and macOS both show the signing identity.

2

Every artifact publishes a SHA256, and the download page shows the same values as Releases.

3

Build scripts live in the repo, so you can reproduce the build and compare.

4

The app performs no online validation and uploads no store data; updates start only when you click.

Fixed and known issues are recorded in the security section of the changelog. Unfixed details are not repeated on this site.