安全修复优先应用于最新发布版本和 main 分支。早期预览版本可能要求先升级后再验证问题。

请使用 GitHub 仓库的 Security > Report a vulnerability 私密报告功能。不要在公开 Issue、讨论区、日志附件或截图中披露可利用细节、用户数据、IP 地址或本机路径。

报告建议包含：

• 受影响版本与 Windows 版本；
• 最小复现步骤和预期影响；
• 是否需要管理员权限；
• 脱敏后的日志或崩溃信息；
• 已尝试的缓解方式。

维护者会先确认收到报告，再评估影响、修复范围和披露时间。修复发布前请避免公开利用方法。

FlowScope 是本机提升权限的监控工具。以下行为属于项目必须保持的边界：

• 不捕获 TCP/UDP 正文；
• 不上传遥测或监控数据；
• 不修改代理、DNS、路由、网卡或防火墙；
• 配置、数据库、图标缓存和日志默认位于 FlowScope.exe 当前目录，WebView2 状态位于当前用户的 %LOCALAPPDATA%\FlowScope\WebView2；
• 卸载默认保留用户数据，只有明确确认后才删除；
• 正式包只包含一个应用 EXE，不安装隐藏服务或独立 Agent。

普通功能故障、指标不可用和兼容性问题请使用 Bug Issue 模板。

Security fixes are prioritized for the latest release and the main branch. Early preview builds may need to be upgraded before an issue can be verified.

Use the repository's private Security > Report a vulnerability feature. Do not disclose exploitable details, user data, IP addresses, or local paths in public issues, discussions, log attachments, or screenshots.

A useful report includes:

• the affected FlowScope and Windows versions;
• minimal reproduction steps and expected impact;
• whether administrator rights are required;
• sanitized logs or crash details; and
• mitigations already attempted.

Maintainers will acknowledge the report before assessing impact, repair scope, and disclosure timing. Please avoid publishing exploitation instructions before a fix is released.

FlowScope is an elevated local monitoring tool. The project must preserve these boundaries:

• no TCP/UDP payload capture;
• no telemetry or monitoring-data uploads;
• no changes to proxy, DNS, routing, adapters, or firewall configuration;
• configuration, databases, icon cache, and logs remain beside FlowScope.exe by default, while WebView2 state uses the current user's %LOCALAPPDATA%\FlowScope\WebView2;
• uninstall keeps user data unless removal is explicitly confirmed; and
• production packages contain one application EXE and install no hidden service or separate Agent.

Use the Bug issue template for ordinary failures, unavailable metrics, and compatibility problems.