refactor: security.md

SECURITY.md

@@ -2,15 +2,14 @@
 
 ## Supported Versions
 
-We actively maintain and provide security updates for the following versions of Freedom Loader:
+Freedom Loader follows a **latest-only** support model. Security fixes are applied to the current release only — no backports to older versions.
 
 | Version       | Supported          |
-|---------|--------------------|
+| ------------- | ------------------ |
-| 1.4.x   | :white_check_mark: |
+| Latest stable | :white_check_mark: |
-| 1.3.x   | :white_check_mark: |
+| Older versions | :x:               |
-| < 1.3.0 | :x:                |
 
-**Note**: We recommend always using the latest version to benefit from the most recent security patches and features.
+I recommend always running the latest version. The built-in auto-updater will notify you when a new release is available. Older versions will not receive security patches regardless of severity.
 
 ## Reporting a Vulnerability
 
@@ -32,37 +31,40 @@ Instead, please report security issues privately by:
 
 ### What to Expect
 
-- **Acknowledgment**: We will acknowledge receipt of your report within 48 hours
+- **Acknowledgment**: I will acknowledge receipt of your report within 48 hours
-- **Assessment**: We will assess the vulnerability and determine its severity
+- **Assessment**: I will assess the vulnerability and determine its severity
-- **Updates**: We will keep you informed of our progress
+- **Updates**: I will keep you informed of our progress
-- **Resolution**: We aim to release a fix within 7-14 days for critical vulnerabilities
+- **Resolution**: I aim to release a fix within 7-14 days for critical vulnerabilities
-- **Credit**: We will credit you in the release notes (unless you prefer to remain anonymous)
+- **Credit**: I will credit you in the release notes (unless you prefer to remain anonymous)
 
 ## Security Best Practices for Users
 
-When using Freedom Loader, we recommend:
+When using Freedom Loader, I recommend:
 
 ### General Security
 
-- **Keep Updated**: Always use the latest version of Freedom Loader
+- **Keep Updated**: Always use the latest version of Freedom Loader — older versions receive no security patches
-- **Official Sources**: Download only from official releases on [GitHub](https://github.com/MasterAcnolo/Freedom-Loader/releases)
+- **Official Sources**: Download only from official sources:
-- **Verify Downloads**: Check that installers are properly signed (Windows SmartScreen may show warnings for new releases)
+  - [GitHub Releases](https://github.com/MasterAcnolo/Freedom-Loader/releases)
+  - [Fedora COPR](https://copr.fedorainfracloud.org/coprs/masteracnolo/freedom-loader/)
+  <!-- - [Snap Store](https://snapcraft.io/freedom-loader) -->
+- **Verify Downloads**: Check that installers are from one of the above sources
 - **Antivirus**: Keep your antivirus software up to date
 
 ### Configuration Security
 
-- **Download Path**: Only set download paths within your user directory (`C:\Users\[USERNAME]\...`)
+- **Download Path**: Only set download paths within your user directory
 - **Cookies**: Be aware that Firefox cookies are used for authentication — keep Firefox secure
-- **Logs**: Logs may contain sensitive information—avoid sharing them publicly without review
+- **Logs**: Logs may contain sensitive information such as URLs or local paths — avoid sharing them publicly without review
 
 ### Privacy Considerations
 
 Freedom Loader respects your privacy:
 
-- **No Data Collection**: We don't collect, store, or transmit your personal data
+- **No Data Collection**: I don't collect, store, or transmit your personal data
 - **No Telemetry**: No usage tracking or analytics
 - **Local Operation**: All downloads are processed locally on your machine
-- **Optional Features**: Discord RPC is optional and can be disabled
+- **Optional Features**: Discord RPC is optional and can be disabled in settings
 
 ## Known Security Considerations
 
@@ -71,16 +73,16 @@ Freedom Loader respects your privacy:
 Freedom Loader accesses Firefox cookies to download protected content. This is:
 
 - **By Design**: Required for age-restricted or member-only content
-- **Local Only**: Cookies are read locally and never transmitted
+- **Local Only**: Cookies are read locally and never transmitted outside your machine
-- **User Controlled**: You can control what content you download
+- **User Controlled**: You control what content you download
 
 ### Native Dependencies
 
-Freedom Loader bundles native binaries:
+Freedom Loader bundles the following official binaries:
 
-- **yt-dlp**: Official builds from [yt-dlp/yt-dlp](https://github.com/yt-dlp/yt-dlp)
+- **yt-dlp**: Official builds from [yt-dlp/yt-dlp](https://github.com/yt-dlp/yt-dlp) — auto-updated on each launch
 - **FFmpeg**: Official builds from [FFmpeg.org](https://ffmpeg.org/)
-- **Deno**: Official builds from [Deno.land](https://deno.land/)
+- **Deno**: Official builds from [Deno.com](https://deno.com/)
 
 These dependencies are verified and updated regularly.
 
@@ -91,13 +93,13 @@ New releases may trigger Windows Defender warnings because:
 - The application is not yet widely distributed
 - Code signing certificates are expensive for open-source projects
 
-This is expected behavior for new releases. The warning will decrease as more users download the software.
+This is expected behavior for new releases and will diminish as more users download the software.
 
 ## Vulnerability Disclosure Policy
 
 ### Our Commitment
 
-We are committed to:
+I am committed to:
 
 - Responding promptly to security reports
 - Working with security researchers to verify and address issues
@@ -107,9 +109,9 @@ We are committed to:
 ### Disclosure Timeline
 
 1. **Day 0**: Vulnerability reported privately
-2. **Day 1-2**: Acknowledgment sent to reporter
+2. **Day 1–2**: Acknowledgment sent to reporter
-3. **Day 3-7**: Vulnerability assessed and fix developed
+3. **Day 3–7**: Vulnerability assessed and fix developed
-4. **Day 7-14**: Fix released (critical vulnerabilities prioritized)
+4. **Day 7–14**: Fix released (critical vulnerabilities prioritized)
 5. **Day 14+**: Public disclosure (coordinated with reporter)
 
 ### Scope
@@ -129,16 +131,16 @@ The following are generally not considered security vulnerabilities:
 - Issues requiring physical access to the user's machine
 - Social engineering attacks
 - Denial of service against third-party services
-- Issues in third-party dependencies (report to upstream projects)
+- Issues in third-party dependencies (report to upstream projects directly)
-- Missing security headers on local HTTP server (no remote access)
+- Missing security headers on the local HTTP server (not exposed remotely)
 
 ## Security Updates
 
 Security updates are released as:
 
-- **Patch Releases**: For critical security fixes (e.g., 1.4.1 → 1.4.2)
+- **Patch Releases**: For critical security fixes (e.g., 1.6.0 → 1.6.1)
 - **Automatic Updates**: Users are notified via the built-in update system
-- **Release Notes**: Security fixes are clearly marked in changelog
+- **Release Notes**: Security fixes are clearly marked in the changelog
 
 ## Additional Resources
 
@@ -150,6 +152,7 @@ Security updates are released as:
 
 For security-related questions or concerns:
 
+- **Email**: masteracnolo25@gmail.com
 - **GitHub**: [@MasterAcnolo](https://github.com/MasterAcnolo)
 
 ---