Bihar Police Notebook is a fully static web application — there is no application server that receives or stores officer notes. All documents are written to the user’s own browser storage (IndexedDB, scoped to the originDocumentation Index
Fetch the complete documentation index at: https://mintlify.com/arverma/Bihar-Police-Notebook/llms.txt
Use this file to discover all available pages before exploring further.
bpdiary.arverma.dev), and the optional Google Drive backup is both opt-in and limited to the narrowest possible scope. Understanding these boundaries is essential context for anyone evaluating the security posture of the project.
How the App Stores Data
Local IndexedDB
All notes and case diaries are stored exclusively in the user’s browser IndexedDB, scoped to the origin
bpdiary.arverma.dev. No document content is sent to any server operated by this project.Optional Drive Backup
Users can connect Google Drive. The OAuth flow requests only the
drive.file scope, which limits access to files created by the app. Disconnecting revokes the token but does not delete Drive files the user already owns.Security fixes are applied to the latest code on the
main branch. There are no versioned release tracks receiving backported patches.Access Token Caching
Drive access tokens are cached in the browser’s IndexedDB for up to 24 hours to avoid re-prompting on every page refresh.Scope for Security Researchers
In Scope
These issues are meaningful and should be reported privately:- Editor XSS that can read or alter documents stored in local IndexedDB
- Unexpected OAuth scope escalation beyond
drive.file(e.g. the app requesting broader Drive or Google Account access without user intent) - Data exfiltration from the editor to any external infrastructure not disclosed to the user
Out of Scope
The following are not considered vulnerabilities in this project:Malicious Browser Extensions
Attacks that require a compromised or attacker-controlled browser extension running alongside the app are outside this project’s threat model.
User-Initiated Data Clearing
A user clearing site data or switching to a new domain causes IndexedDB data to be inaccessible — this is expected, origin-scoped browser behaviour.
Third-Party Services
Google Input Tools, optional cloud speech, and Google Drive used as designed after explicit user consent are not in scope. Report concerns about those services to Google directly.
Social Engineering & Physical Access
Attacks that depend on deceiving the user or having physical access to their device fall outside the scope of this security policy.
Reporting a Vulnerability
Please report security issues privately so they can be fixed before any public disclosure.Use GitHub Security Advisories (preferred)
Open a private advisory directly at:This is the preferred channel. Your report is visible only to repository maintainers until a fix is published.
Open a Private Security Report
If the advisory form is unavailable, use the GitHub private security report option for this repository.
What to Include in Your Report
Providing the following information allows maintainers to triage and reproduce the issue quickly:| Field | Details to provide |
|---|---|
| Affected surface | Which part of the app is affected (e.g. editor/ transliteration, punctuation panel, Drive OAuth flow) |
| Browser & OS version | Full browser name, version, and operating system (e.g. Chrome 124, Windows 11) |
| Steps to reproduce | A numbered, minimal sequence of actions that triggers the vulnerability |
| Impact | What an attacker can achieve — data exposure, XSS, unexpected permissions, token theft, etc. |
Response SLA
| Stage | Timeline |
|---|---|
| Acknowledgement | Within 7 days of receiving your report |
| Fix timeline | Shared with you after initial triage is complete |