ChronoWard is engineered as a local-first, fully offline computational prosthesis. Data sovereignty, zero telemetry, and hardware-backed encryption at rest are fundamental architectural requirements. No data is ever transmitted to remote servers — all records exist strictly on your local workstation.
| Storage File | Protection Model | Encryption Control |
|---|---|---|
sheets.json |
AES-256-GCM Encrypted | Hardware-backed OS Keychain key (com.chronoward.app) |
timers.json |
AES-256-GCM Encrypted | Hardware-backed OS Keychain key (com.chronoward.app) |
settings.json |
Plaintext / Encrypted | Stores local user preferences & visual configurations |
- Authenticated Encryption: AES-256-GCM with cryptographically secure 96-bit random nonces generated per write transaction.
- Hardware Key Storage: Master 256-bit keys reside in OS keychains (Windows DPAPI, macOS Keychain, Linux
libsecretviakeyring v3) and never touch unencrypted disk storage. - Zero-IPC Memory Caching: Master key is safely cached in application state memory using
secrecy::SecretVec<u8>, preventing OS IPC overhead during rapid timer ticks and typing. - Payload Sentinel & Guard: Files use an
enc1:header sentinel; corrupted or invalid sentinels trigger safe rejection and quarantine. - Unix Permissions: On Unix systems, data directories (
~/.local/share/ChronoWard/timesheet-data/) are restricted to0700(owner-only access).
- Keychain Initialization Guard: The Rust backend (
crypto.rs&state.rs) tracks keychain creation state (is_new_key). - Strict Downgrade Enforcement: If an established OS Keychain key exists on the system, loading unencrypted plaintext files is strictly blocked across all storage commands (
load_sheets,load_timers,load_settings), neutralizing unauthorized downgrade attacks.
- Thread-Safe Serialization: File persistence is governed by an asynchronous write lock (
tokio::sync::Mutex<()>) inAppState, preventing race conditions during simultaneous manual and automatic saves. - Atomic Disk Writes: Save transactions write to temporary
.tmpfiles prior to atomic renaming, preventing partial file corruption. - Orphaned File Purging: Automatic startup routines clean up leftover temporary files (
.tmp.*) older than 1 hour. - Corrupt File Quarantine: Damaged data files are automatically isolated to
<filename>.corrupt.<timestamp>while preserving safe application recovery.
- Export Cell Sanitization:
sanitizeCsvCell()inspects export fields for formula trigger characters (=,+,-,@,\t,\r) and prepends a single quote'to neutralize formula execution in spreadsheet software. - Type Preservation: Uses nullish coalescing logic to preserve legitimate numeric
0and booleanfalsevalues without data loss.
- Isolated WebViews: Main Window (
index.html), Quick Capture HUD (hud.html), and Overlay Widget (overlay.html) execute in isolated window capability contexts. - Global Shortcuts: System-wide keybindings (
Ctrl+Shift+Space) are registered and handled directly in native Rust space viatauri-plugin-global-shortcut, avoiding webview key-logging vulnerabilities. - Strict Content Security Policy (CSP):
connect-src 'none'enforces hardware-level webview network isolation, preventing any outbound HTTP or WebSocket transmission.
default-src 'self';
script-src 'self' 'unsafe-inline';
style-src 'self' 'unsafe-inline';
font-src 'self';
img-src 'self' data:;
connect-src 'none';
frame-src 'none';
object-src 'none'- Emergency Read-Only Mode: If the OS Keychain becomes unreachable on boot while encrypted files exist, ChronoWard defaults to Emergency Read-Only Mode to protect data.
- Mid-Session Protection: If keychain access fails mid-session, write operations are blocked (
WRITE_BLOCKED_EMERGENCY_MODE) to prevent unencrypted disk leaks. - Mutex Panic Protection: State locks utilize safe unwrapping handlers (
unwrap_or_else) to eliminate thread lock poisoning cascades.
| Threat Vector | Mitigation Strategy | Status |
|---|---|---|
| Local Disk Inspection | AES-256-GCM hardware key encryption at rest | Protected |
| Plaintext Downgrade | Hardware key state checking (is_new_key) & command routing |
Protected |
| Formula Injection | Automatic CSV field sanitization with formula trigger escaping | Protected |
| Save Race Conditions | Asynchronous mutex serialization write lock | Protected |
| Network Data Leaks | Webview CSP network block (connect-src 'none') |
Protected |
| Interrupted Disk Writes | Atomic .tmp file write-and-rename pipeline |
Protected |
| Version | Status | Security Maintenance |
|---|---|---|
| 2.x (Current) | ✅ Active | Fully Supported |
| 1.x | ⚡ Maintenance | Critical Security Patches Only |
| < 1.3 | ❌ Deprecated | End of Life |
RUSTSEC-2024-0429 applies to glib 0.18.5, which enters the dependency graph through Tauri's Linux WebKit/GTK support. The current Tauri and WebKit crate releases do not provide a compatible upgrade to the patched glib 0.20 line.
This advisory is temporarily accepted because ChronoWard is not currently distributed for Linux. Windows releases do not load this Linux GTK dependency. The exception does not permit suppressing the advisory from audit output or publishing a Linux build while it remains unresolved.
- Accepted: 2026-08-24
- Review trigger: Before any Linux release, or when Tauri provides a compatible patched dependency path
- Required action: Re-run
cargo audit --deny unsound, upgrade to the maintained dependency path, and complete Linux-specific testing before distribution
To report a security vulnerability, please open a report via GitHub Security Advisories or contact the project maintainers directly.
Initial response SLA: 48 hours.