Security

Reporting Vulnerabilities

If you discover a security vulnerability in Varve, please report it privately through the GitHub Security Advisory system. This allows us to address the issue before it is publicly disclosed.

We aim to acknowledge receipt of vulnerability reports within 48 hours and provide an initial assessment of severity and expected timeline for a fix. We follow coordinated disclosure practices and request that reporters allow reasonable time for a fix to be developed and released before public disclosure.

Website Security

The Varve website enforces the following security measures:

  • HTTPS enforced — all connections use TLS encryption
  • Content Security Policy configured to restrict resource loading and mitigate XSS attacks
  • Dependency audits via Dependabot for automated vulnerability detection
  • Static site hosting — no server-side execution, reducing attack surface

Download Integrity

Currently, Varve builds are not code-signed. This is a known limitation that will be addressed as the project matures. For stable releases, we plan to provide:

  • SHA256 checksums for all build artifacts
  • Cryptographic signing of release binaries
  • Reproducible build verification instructions

Until code signing is implemented, we recommend verifying downloads by building from source or checking the GitHub release page for checksum information. Always download Varve from the official GitHub releases page, not from third-party mirrors.

Dependency Management

Varve takes dependency security seriously. The project uses multiple layers of automated dependency auditing:

  • npm audit — scans JavaScript dependencies for known vulnerabilities
  • cargo audit — scans Rust crates (both workspace and Tauri backend) for known vulnerabilities
  • Dependabot — automated pull requests for dependency updates with vulnerability information

All dependencies are reviewed before update. Breaking changes are evaluated for impact and tested before merging. The project maintains a minimal dependency footprint where possible.

Code Review

All pull requests to Varve must pass review before merge. The review process includes:

  • Code quality and correctness review by maintainers
  • Automated test suite execution (all tests must pass)
  • Type checking (TypeScript strict mode, Rust type safety)
  • Linting (Biome for JavaScript, Clippy for Rust)
  • Security-sensitive changes receive additional scrutiny

Supply Chain

Varve implements several supply chain security measures:

  • Lockfiles committed — both pnpm-lock.yaml and Cargo.lock are committed to the repository, ensuring deterministic dependency resolution
  • Dependency versions pinned — exact versions specified to prevent unexpected updates
  • CI verification — continuous integration validates dependency integrity and runs security audits on every pull request

Data Security

As a local-first application, Varve's security model is straightforward:

  • All design data stays on your machine — no cloud storage, no remote servers
  • No telemetry — the application does not phone home or transmit usage data
  • No user accounts — no authentication system to compromise
  • Local storage only — data persisted via SQLite (desktop) or IndexedDB (web)
  • No cloud transmission without explicit user action (e.g., filing a GitHub issue)
Report a Vulnerability Back to About