feat: publish Alta Local Camera Discovery

2026-09-01 18:02:14 +00:00
commit 33f28a3d73
30 changed files with 4939 additions and 0 deletions
@@ -0,0 +1,16 @@
+# Security
+
+Alta Local Camera Discovery does not request or store Alta credentials. It listens for local `_vaioncam._tcp.local` mDNS announcements, validates expected Alta camera record structure, and restricts privileged Electron actions to a narrow main-process policy.
+
+## Trust model
+
+- mDNS is unauthenticated LAN input. The app correlates service identity, camera key, hostname, port, and local address, but cannot cryptographically prove that an advertiser is a genuine Alta camera.
+- Camera Web UI links are HTTPS root URLs authorised only by the latest successful scan.
+- The Electron renderer is sandboxed, context-isolated, denied general permissions, and served through an allowlisted `app://` protocol.
+- CSV generation and filesystem writes remain in the main process.
+
+## Release status
+
+Release assets are produced from tagged GitPeji commits with a locked dependency graph and published SHA-256 checksums. Windows artifacts are currently unsigned internal releases and may trigger Microsoft Defender SmartScreen.
+
+Report suspected issues through the repository issue tracker or directly to the internal tool owner. Do not include credentials, camera exports, or customer data in reports.