# 🔐 Security Policy — HardMon

Thank you for helping keep **HardMon** and its users safe.

---

## Supported Versions

| Version | Supported | Notes |
|---|---|---|
| 1.0.x | ✅ Active | Current stable line |
| < 1.0 | ❌ | No longer maintained |

---

## Reporting a Vulnerability

**Please do not open a public GitHub issue for security problems.**

Instead, use **GitHub Private Vulnerability Reporting**:

1. Open the **Security** tab of this repository
2. Click **"Report a vulnerability"**
3. Describe the issue with as much detail as possible

If that is unavailable, contact the maintainer via the contact links on the profile page associated with this repository.

### What to include

- A clear description of the issue
- Steps to reproduce
- HardMon version (see **About** dialog inside the app)
- Windows version and build
- Any proof-of-concept, screenshots, or logs (**redact personal data**)

### What to expect

| Stage | Target timeframe |
|---|---|
| Acknowledgement | within 72 hours |
| Initial triage | within 7 days |
| Fix or mitigation | best-effort, timeline shared in the report |
| Public disclosure | coordinated after a fix ships |

We follow responsible disclosure. Please give us a reasonable window before making the issue public.

---

## Scope

### In scope
- The HardMon executable (`HardMon.exe`)
- The distribution archive (`HardMon_1.0.0_Windows_x64.zip`)
- The landing page (HTML/CSS/JS) published via GitHub Pages
- Any official scripts published in this repository

### Out of scope
- Third-party tools used to extract the archive
- Windows OS vulnerabilities
- Hardware / firmware / driver flaws
- Issues that require a pre-compromised system
- "SmartScreen warns on the binary" — this is expected for unsigned software (see below)

---

## Binary Integrity

Because the download archive is **password-protected and redistributed as a raw binary**, integrity verification is important.

Verify on Windows:

```powershell
Get-FileHash .\HardMon.exe -Algorithm SHA256
Get-FileHash .\HardMon_1.0.0_Windows_x64.zip -Algorithm SHA256
```

If a hash does not match, **do not run the file**. Re-download from the official landing page only.

---

## About the Archive Password

The distribution archive password is:

```
github26
```

This password is **public** and **not a security control**. Its purpose is:

- Prevent automated browser scanners from quarantining the file mid-download
- Ensure users receive the exact, unmodified binary that was published
- Provide a small, deterministic step where the user can verify hash first

Never trust a copy of `HardMon_1.0.0_Windows_x64.zip` obtained from anywhere other than the official download page.

---

## SmartScreen & Antivirus Warnings

`HardMon.exe` is **not code-signed** with an EV certificate. As a result:

- **Windows SmartScreen** will warn on first run → expected, verify hash, then run
- **Some AV engines** may flag unsigned/new binaries → verify hash, then whitelist
- **No** network traffic is generated by the application itself

If your scanner flags the binary, please report it to the vendor using the hash from this file so they can whitelist it.

---

## Privacy

HardMon is **privacy-first**:

- No telemetry
- No analytics
- No identifiers
- No cloud calls
- No background services

If you observe network activity attributed to `HardMon.exe`, treat it as a security incident and report it via the process above.

---

## Permissions

HardMon runs as a **standard user** by default. Optional elevation (running as administrator) unlocks additional temperature sensors but is never required for CPU / RAM / disk / network monitoring.

HardMon does **not**:

- Install drivers
- Register services
- Modify the registry beyond standard per-user config
- Create scheduled tasks
- Persist beyond its own folder

---

## Safety Notes for Users

1. Download **only** from the official landing page.
2. Verify **SHA-256** before running.
3. Extract with 7-Zip / WinRAR; the password is public — this is not a barrier, it is a transport wrapper.
4. If Windows or your AV blocks the file, do **not** disable your security software — verify the hash instead.
5. Report anything suspicious.

---

Thank you for helping keep HardMon safe.