Security fixes are provided for the latest released version.

Please do not open a public issue for security problems.

Report vulnerabilities privately through GitHub: Security → Report a vulnerability.

Include a description, the affected version, and a minimal program that reproduces the issue. We aim to acknowledge reports within a few business days and to release a fix or mitigation as soon as a valid issue is confirmed.

This package is a provider for TagBites.IO. The core security model - no sandbox, paths are the only limit, advisory permissions, content buffered through the system temporary directory - is described in the core security policy. What follows is specific to this provider.

A mounted drive letter is visible to every process running in that Windows session, with the privileges of the process that created the mount. Anything reachable through the mounted FileSystem - a remote FTP server, a cloud bucket, a composed virtual tree - becomes reachable as an ordinary drive by any code the user runs.

Mount the narrowest tree that works, and treat the mount as being as trusted as the least trusted process in the session.

This provider depends on the Dokan kernel driver. Its installation and version are part of the trust boundary.