Skip to main content

Security

FOLDR is designed as a local file-management tool. It does not require an account or elevated privileges to organize files. Treat filesystem access, path handling, and destructive operations as security-sensitive parts of the codebase.

Reporting a vulnerability​

Please do not publish an unpatched vulnerability in a public issue. Send a private report to foldr@qasimio.me.

Include, where possible:

  • a concise description and potential impact;
  • the affected FOLDR version and operating system;
  • reproducible steps or a minimal proof of concept;
  • any relevant logs, with private paths and personal data removed.

Areas that need careful review​

  • Path traversal and path normalization.
  • Symlinks, race conditions, and files changing during an operation.
  • Destination conflicts and overwrite prevention.
  • Ignore-rule matching.
  • History integrity and undo validation.
  • Sensitive information in logs and diagnostic output.
  • Irreversible duplicate-removal behavior.

Security-sensitive changes should include regression tests and clear user-facing behavior when an operation is skipped or rejected.