Security Policy

Security Policy

Last updated 25 July 2026, document revision 1.6

PC Workman monitors low-level system data and can perform elevated actions such as changing power plans, managing services and applying supported fan controls. Basic monitoring does not require administrator rights. That access deserves verifiable security. This page summarises how releases are protected and how you can check them yourself. The full policy lives in SECURITY.md.

How every release is protected

• Sigstore digital signatures - cryptographic proof that a release is authentic, active since January 20, 2026.
• VirusTotal scanning: every .exe is checked against 70+ antivirus engines before release. Version 1.8.7 returned 1/70. The single detection is Bkav Pro, a heuristic engine widely known for false positives on PyInstaller-packed binaries; the other 69 engines report clean.
• CodeQL - automated security scanning on every commit to main.
• Private vulnerability reporting + Dependabot alerts on GitHub.
• Documented testing - version, date and results recorded publicly; source tagged and archived per release.

Verify it yourself

Before running any release, you can confirm it is authentic and clean:

1. Verify the Sigstore signature

sigstore verify github \
  PC_Workman_HCK_<version>.exe \
  --bundle sigstore.bundle

If verification fails, do not run the file - report it.

2. Check the SHA256 hash against the value in the release notes

Get-FileHash PC_Workman_HCK_<version>.exe -Algorithm SHA256

3. Scan it on VirusTotal (expected: 0 detections) and read the source - every line is on GitHub.

Privacy & data

PC Workman is local-first: all system-monitoring data, learned baselines, the offline hck_GPT assistant and your history stay on your device. An anonymous hardware & usage snapshot can be sent to help fix hardware incompatibilities. It is enabled by default and can be turned off in Settings. The payload includes component models, OS, region from your language setting, app version and session length. It never includes your name, IP address, files or process names.

Full details: Privacy Policy (EN + PL) and PRIVACY.md.

Supported versions

Reporting a vulnerability

Please report security issues privately, not in public issues:

• Preferred: GitHub → Security tab → "Report a vulnerability".
• Alternative: email firmuga.marcin.s@gmail.com with subject [SECURITY] PC Workman.

Response timeline: acknowledgment within 24 hours, validation and severity within 72 hours, a fix for critical issues (CVSS 7.0+) within 7 days. Reporters are credited unless anonymity is requested.

Status at a glance