[Bare7a]

📝 What changed?

BarSQL now has a security policy, SECURITY.md, which GitHub shows on the repository's Security tab. It sends reports to GitHub's private vulnerability reporting, already on for the repository and behind the issue chooser's "🔒 Security issue" link. It also covers what happens to a report, which versions get fixes, what counts as a vulnerability and how to verify a download.

• Reporting: the private advisory form, or bare7a@gmail.com, the private contact the privacy policy already gives. A report needs the version line from About's copy button, the OS, how BarSQL was installed and the engine, and no real credentials or data.
• What happens next: a reply within a week and a fix in a new release, which the updater offers at launch. Then the advisory is published, with a CVE where the problem warrants one and credit for the reporter. Details stay private until then, or for 90 days at most.
• Supported versions: the latest release only. A build from source doesn't check for updates at launch, so it's rebuilt from the latest tag.
• Scope: examples in the app's own labels:
  • a write past Read-only
  • an AI assistant getting past Allow AI assistants (MCP), Allow changes or Ask before running changes
  • credentials reaching a log or another server
  • TLS or host key checks accepting the wrong server
  • SQL loading an extension
  • the updater installing anything but the release's file
• Known limits: what works this way by design, so it isn't reported as a vulnerability:
  • plain-text credentials in connections.json (0600 on macOS and Linux)
  • require accepting any certificate
  • read-only on SQL Server and Turso being BarSQL's own check
  • extensions running as native code
  • AI assistants steered by what they read
  • updates trusting GitHub without checking attestations
  • the unsigned Windows builds
• Verifying downloads: gh attestation verify for any release file.

🧩 Type of change

• 🐛 Bug fix
• ✨ Feature
• ♻️ Refactor
• ⬆️ Dependencies
• 📝 Docs or landing page
• 🛠️ Build, CI or packaging

🧪 Tested

• By hand on Windows
• By hand on macOS
• By hand on Linux
• Tests workflow on macOS and Windows

📖 Docs

• Updated the guide
• Updated the README or landing page
• No docs needed

📌 Notes

• Each limit was checked against the code:
  • json_file.rs sets 0600 on Unix only.
  • require accepts any certificate on every engine: AcceptAnyCert, MySQL's danger_accept_invalid_certs and SQL Server's trust_cert.
  • SQL Server's read intent only routes to a readable secondary.
  • The updater refuses an asset SHA256SUMS doesn't list.
• Links are absolute, like the issue templates', since GitHub also shows the file on the Security tab. All of them resolve.
• v1.2.5's BarSQL-darwin-arm64.zip, the file in the example command, has its attestation.
• The README doesn't link the policy, since GitHub links it from the Security tab.