This document covers two distinct security topics:

1. Reporting vulnerabilities in Canary's code
2. Operational security guidance for users investigating sensitive topics

If you discover a security vulnerability in Canary, please report it responsibly:

1. Do not open a public GitHub issue
2. Email the maintainers at the address in the repository (or use GitHub's private vulnerability reporting if enabled)
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

We aim to acknowledge reports within 48 hours and provide a fix timeline within 7 days.

Canary is designed for investigating potentially sensitive topics. While all data sources are public, the act of investigation may draw attention. This guide helps you protect yourself.

Consider who might be interested in your investigation:

[ ] Device has full-disk encryption enabled
[ ] Screen lock is configured (short timeout)
[ ] OS and browser are up to date
[ ] No unnecessary browser extensions installed
[ ] Using a dedicated browser profile or VM

For routine research:

• A reputable commercial VPN is sufficient
• Choose servers outside jurisdictions of interest

For sensitive investigations:

• Consider Tor Browser for web research
• Use Tails OS for maximum compartmentalization
• Be aware that Tor exit nodes can see unencrypted traffic

What Canary accesses:

• State licensing databases (public government websites)
• US Census Bureau API (geocoding)
• Optional: FEC, SAM.gov, and other federal APIs
• Optional: AI providers if configured (see Privacy section below)

Canary stores all data locally in data/canary.db (SQLite). Consider:

[ ] Database location is on encrypted storage
[ ] Backup strategy that maintains confidentiality
[ ] Clear plan for secure deletion when investigation concludes

Secure deletion on different platforms:

• macOS: rm -P data/canary.db (3-pass overwrite)
• Linux: shred -u data/canary.db
• Windows: Use a secure deletion tool

If you need to create accounts (for API keys, etc.):

• Use a dedicated email address (ProtonMail, Tutanota)
• Never reuse usernames from personal accounts
• Pay with privacy-preserving methods if subscriptions are needed

• Keep investigation notes in encrypted storage
• Avoid cloud sync for sensitive working documents
• Use Signal or encrypted email for collaborator communication

If using AI features:

Recommendation: Use local providers (Ollama, LM Studio) for sensitive investigations. Cloud providers may log queries.

When attaching evidence files:

• Strip metadata from images before import (exiftool -all= photo.jpg)
• PDF files may contain author/creation metadata
• Screenshots may contain identifying information in browser UI

[ ] Findings independently verified
[ ] Legal review completed (if publishing)
[ ] Subjects given opportunity to respond (journalistic ethics)
[ ] Personal information of uninvolved parties redacted

When sharing databases or reports:

• Export only necessary records, not entire database
• Review exports for unintended personal data
• Use encrypted channels for sharing (Signal, encrypted email)

If your investigation involved tips or sources:

• Never include source-identifying information in Canary
• Keep source communications separate from investigation data
• Consider legal protections available in your jurisdiction

This is not legal advice. Consult qualified counsel for your jurisdiction.

• Accessing public records is generally lawful
• Web scraping of public data is generally permitted (see hiQ v. LinkedIn)
• Publishing findings may have defamation implications
• Journalist shield laws vary by jurisdiction
• FOIA/public records requests are complementary tools

If you believe your investigation has been compromised:

1. Stop using the affected device/account
2. Preserve evidence of the compromise
3. Assess what data may have been accessed
4. Notify affected parties if appropriate
5. Report to relevant authorities if criminal activity suspected

• EFF Surveillance Self-Defense
• Committee to Protect Journalists Digital Safety
• Freedom of the Press Foundation
• NICAR-L mailing list - Data journalism community

Canary incorporates these security principles:

For security questions not covered here, open a GitHub Discussion or contact maintainers directly.