Do NOT file a public GitHub issue for security vulnerabilities.

1. Go to the Security tab
2. Click "Report a vulnerability"
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Affected versions
   • Potential impact
   • Suggested fix (if any)

• SQL injection via unsanitized Drift query inputs
• Path traversal in file read/write operations (PDF, image)
• Insecure local storage of sensitive shop or payment data
• Void/refund bypass — circumventing atomic void flow to manipulate stock or revenue
• Inventory log tampering — modifying audit trail records outside application flow
• Dependency vulnerabilities in third-party packages

• UI bugs or UX issues
• Missing features
• Configuration errors by the user
• Device-level security (screen lock, etc.) — outside app scope

Promsell is an offline-first local app with no network access by default:

1. Local-only storage — all data stays on device via SQLite
2. No server communication — no API keys, no remote calls in core flow
3. App settings table (Drift-backed) — stores non-sensitive settings (locale, theme, shop name, VAT mode, stock policy); also stores receipt sequence counter and device prefix
4. Atomic transactions — sale creation, void, and stock adjustments run inside Drift DB transactions to prevent partial writes
5. Inventory audit trail — all stock changes (SALE, VOID_REVERSAL, ADJUSTMENT_IN/OUT) are logged immutably in inventory_logs table
6. Backup encryption v2 (v0.7.5+) — AES-256-GCM with PIN-derived PBKDF2-HMAC-SHA256 at 100,000 iterations (RFC 2898). v1 format (weak ~3 HMAC rounds) still decrypts for backward compatibility but new backups use v2. Toggle in Settings → Backup
7. Image format validation (v0.7.5+) — ProductImageService._isValidImage() rejects non-image files (.jpg, .jpeg, .png, .webp, .gif, .bmp, .heic only); prevents malicious file upload via picker
8. Image cache eviction (v0.7.5+) — ImageCacheService enforces 50MB LRU limit on /images/ directory; prevents disk space exhaustion from uncompressed product photos
9. PDF generation — local only, no upload
10. Orphaned image cleanup (v0.8.0+) — AddProductPage tracks temp image paths and deletes orphaned files on dispose/discard; ClearOrphanedImages usecase removes unused images from /images/ directory. Prevents disk space exhaustion from abandoned temp files
11. Dependency hygiene — keep flutter pub upgrade current; run flutter pub audit

For the full fix history, see CHANGELOG.md.