mirror of
https://github.com/QM4RS/FridaBox.git
synced 2026-09-16 14:12:11 +02:00
51 lines
2.1 KiB
Markdown
51 lines
2.1 KiB
Markdown
# Security policy
|
|
|
|
## Supported version
|
|
|
|
FridaBox 4.x is the actively maintained research line. Older inherited launcher
|
|
versions are not supported.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please use GitHub's private **Report a vulnerability** security-advisory flow for
|
|
this repository when it is available. Do not open a public issue for a flaw that
|
|
could expose imported APKs, JavaScript agents, device data, signing material, or
|
|
an unintended network listener.
|
|
|
|
If private vulnerability reporting is unavailable, request a private reporting
|
|
channel through [LinkedIn](https://www.linkedin.com/in/mahdikarzari) or
|
|
[Telegram](https://t.me/QM4RS). Do not include credentials, private APKs,
|
|
proprietary agents, or an operational exploit in the initial message.
|
|
|
|
Include:
|
|
|
|
- affected commit/version and Android build;
|
|
- device model, ABI, and ROM/vendor information;
|
|
- a minimal reproduction using an APK you are allowed to share;
|
|
- impact and the crossed trust boundary;
|
|
- sanitized logs or a small proof of concept;
|
|
- whether the issue reproduces in On-device, Computer, Clean, or all modes.
|
|
|
|
Please allow reasonable time for validation and a coordinated fix before public
|
|
disclosure.
|
|
|
|
## Security model
|
|
|
|
- FridaBox processes APKs and JavaScript selected explicitly by the user.
|
|
- Imported APKs and on-device agents are untrusted code and execute inside the
|
|
host application's Android security boundary.
|
|
- On-device agents have the same effective access as their virtual guest process.
|
|
- Gadget is configured for device loopback. ADB forwarding is an explicit
|
|
computer-side action.
|
|
- Private files reduce accidental exposure but do not create a hardware-backed
|
|
isolation boundary between the host, guest, and agent.
|
|
- FridaBox is not designed to hide from a hostile guest, kernel inspection,
|
|
SELinux inspection, Play Integrity, hardware attestation, or advanced RASP.
|
|
|
|
## Responsible use
|
|
|
|
Use FridaBox only on software and devices you own or are explicitly authorized
|
|
to assess. The maintainers do not support credential theft, unauthorized access,
|
|
surveillance, malware deployment, piracy, or bypassing protections outside a
|
|
lawful research or defensive-testing scope.
|