# Security

## Reporting a vulnerability

If you've found a security issue in Earhorn Music for GNU/Linux, please **do not** report it in public. Public reports are not a place for vulnerability disclosure — the right place is private email so a fix can ship before details become public.

**Email:** [`foundry@faveat.software`](mailto:foundry@faveat.software)

Include:

- A description of the issue.
- Steps to reproduce — the smaller the repro, the faster the fix.
- The version of Earhorn affected (`Help → About` shows it, or check the `.deb` / `.AppImage` filename).
- Your environment (distro, kernel, JDK version) if relevant.
- Whether you've disclosed the issue anywhere else, and whether you'd like credit in the fix announcement.

You'll get an acknowledgment within a few days. Real fix turnaround depends on the severity and complexity — most reasonable issues resolve in under two weeks.

## Threat model

Earhorn is a local-network music player. Its threat model is correspondingly narrow, but it does listen on, and parse data from, your LAN:

| Asset | Threat | Defense |
|-------|--------|---------|
| Your music files | Read by an attacker on your LAN | None inside Earhorn — this is your server's responsibility. Run MinimServer or your DLNA server with authentication if your network isn't trusted. |
| Your playback state | Observed by an attacker on your LAN | SSDP, DLNA and UPnP event traffic is plaintext per the standard. Cast traffic is TLS, but Cast devices are not authenticated (as with every Cast sender). Earhorn doesn't add encryption on top; this is a function of the protocols, not the application. |
| Your machine | Code execution or misuse from malicious data sent by a server, Cast device or other LAN host | libvlc and jUPnP parse server-supplied media and XML; both are mature, widely used codebases. Earhorn also contains small hand-written parsers — audio tags (ID3 / FLAC / Ogg / MP4), Cast message framing, LRC lyrics, M3U playlists, and a minimal HTTP proxy. They are written to reject malformed input rather than crash, and bug reports against them are in scope. DIDL-Lite metadata carrying a DTD is refused. |
| Your machine | Commands from any LAN host to the listening services (UPnP event port, the speaker-group stream proxy, and the optional MediaRenderer) | LAN broadcast (the MediaRenderer) is **off by default**, and anyone on the network can control it once it is on — enable it only on networks you trust. It accepts only `http`/`https` stream addresses on other machines, so a peer cannot make it open local files, devices, or services on this computer. It sends now-playing updates only back to the machine that asked for them, so a peer cannot point them at another machine (the CallStranger problem, CVE-2020-12695). The stream proxy runs only while casting to a speaker group and serves only addresses it issued, each behind a random token. |
| Your lyrics-lookup metadata | Observed by an attacker on the path to lrclib.net, or by lrclib.net | The lookup is **on by default**; turn it off with Settings → Lyrics → *Allow external service calls*. The traffic is HTTPS and carries title, artist, album, duration and an app User-Agent. |
| Your listening history | Read by other users of the same computer | Earhorn's config, data and cache folders are created owner-only (0700), the preferences and session files 0600. |
| Your filesystem | Earhorn accessing files it shouldn't | Earhorn reads music streams from your UPnP server (network sockets) and writes preferences / cache files to standard XDG directories. It does not scan or index local files; it opens a local file only when a playlist you load points at one. |

See [`PRIVACY.md`](PRIVACY.md) for the full list of connections Earhorn makes and the ports it listens on.

## What's _not_ in scope

- **Attackers with physical access to your machine.** They can install anything. Earhorn doesn't pretend to protect against that.
- **Malicious UPnP servers on your LAN.** If you've connected your machine to a hostile network, your DLNA discovery will find whatever's on it; this is true of any DLNA client. Don't auto-connect to networks you don't trust.
- **Bugs in libvlc, jUPnP, Jetty, OkHttp, Compose Multiplatform, the JDK, or the JVM.** Report those to the respective upstream projects; Earhorn will pick up fixes when it bumps dependencies.

## Disclosure policy

- I'll acknowledge your report within a few days.
- I'll work toward a fix and coordinate a disclosure timeline with you. Standard practice is to fix-then-disclose; coordinated disclosure works fine.
- Credit in the fix announcement is yours unless you prefer otherwise. Anonymous reports are also welcome.

## Signed releases

The `.deb` and `.AppImage` packages are published at [faveat.software/earhorn](https://faveat.software/earhorn/#download), with a `SHA256SUMS` file listing the SHA-256 checksum of every download. Save `SHA256SUMS` next to your download and verify with:

```bash
sha256sum -c SHA256SUMS --ignore-missing
```

If you build from source, verify the source zip the same way: it is listed in the same `SHA256SUMS`.