Skip to content

Security: amin-norollah/DiskWiper

Security

SECURITY.md

Security Policy

Reporting a vulnerability

diskWiper permanently overwrites data, so security and correctness issues are taken seriously. Please do not open a public issue for a security problem.

Instead, report it privately by email to a.norollah.official@gmail.com with:

  • a description of the issue and its impact,
  • steps to reproduce (or a proof of concept), and
  • the affected version / commit.

You can expect an acknowledgement within a few days. Please give us reasonable time to release a fix before any public disclosure.

What counts as a security issue here

  • Any path by which diskWiper could overwrite or destroy existing user files (it must only ever write into its own scratch directory in free space).
  • Any way to bypass the confirmation / precheck safeguards for system, boot, read-only, or network volumes.
  • Incorrect claims of sanitization that could give users a false sense of safety.
  • Memory-safety issues in the unsafe FFI layer (src/platform/).

Scope and expectations

diskWiper is provided "as is" (see LICENSE). It is a best-effort free-space sanitizer; on SSDs and copy-on-write filesystems it cannot guarantee complete sanitization; this is documented, not a vulnerability. See docs/SECURITY.md for the full threat model and the technical security discussion.

There aren't any published security advisories