GitHub6 Open Neoma

Security

A small attack surface, on purpose.

Neoma has no server, no accounts and no data transmission. That removes whole classes of risk. What remains is the content you open in it, and we treat that seriously.

Report a vulnerability Privacy and the shipped CSP →

Notes never run code

Raw HTML in Markdown is dropped by the render pipeline. Links, embeds, maths and callouts are rendered from a syntax tree, not injected.

A strict content policy

The desktop app ships a Content Security Policy with no remote host in connect-src, no plugins and no framing.

Imports are untrusted

ZIP entries with path traversal or hidden segments are skipped. Imported files are treated as data.

Your disk, your keys

Vaults live in your browser storage or your own folders. Use your operating system's disk encryption for encryption at rest.

Offline by design

The service worker caches only Neoma's own build files. Remote images and video are blocked unless you allow them.

Auditable

The web edition's source is public under the AGPL. The network audit shows how to check it.

Policy

Reporting a vulnerability

Neoma's security model

Neoma is a fully client-side application. There is no server, no account system and no data transmission — which removes whole classes of risk, but the following still matter:

  • Rendered Markdown must never execute script. The render pipeline drops raw HTML (no rehype-raw); rendered output is sanitised by construction.
  • Imported ZIP archives are untrusted input. Entries with path traversal (..) or hidden segments are skipped.
  • Vault data at rest uses the browser's storage (IndexedDB) or the user's own files. Neoma does not add encryption at rest; use OS-level disk encryption if you need it.
  • The service worker only ever caches same-origin build assets.

Supported versions

Only the latest release receives security fixes.

Reporting a vulnerability

Please report vulnerabilities privately:

  • Discord: panda2187
  • Or use GitHub's Report a vulnerability (Security Advisories) on the repository

Please include reproduction steps and the impact you foresee. You should receive an acknowledgement within 7 days. Please do not open public issues for unpatched vulnerabilities.

Scope notes

  • XSS via note content (wiki links, embeds, math, callouts, imported files) is in scope and treated as high severity.
  • Anything requiring a malicious browser extension or compromised OS is out of scope.