Deco (Developer Compact) is local-first disk cleanup software for developer machines. This document describes supported versions, how to report vulnerabilities, and how the product limits destructive behavior.
| Version | Supported |
|---|---|
| Latest release (GitHub Releases) | Yes |
| Prior 0.9.x | Best-effort fixes for security issues only |
| Pre-0.9.0 / dev builds | Not supported |
Security fixes ship in the next tagged release following responsible disclosure. We do not maintain long-lived LTS branches.
Please do not open public GitHub issues for security vulnerabilities.
Report privately via GitHub Security Advisories:
Create a private security advisory
Include:
- Affected version(s) and platform (Windows / macOS / Linux)
- Steps to reproduce
- Impact assessment (data loss, privilege escalation, remote code execution, etc.)
- Proof of concept if available
We aim to acknowledge reports within 7 days and provide a fix timeline when possible. We may request a coordinated disclosure date.
Deco is designed to reduce accidental data loss, not to sandbox arbitrary file operations:
| Control | Behavior |
|---|---|
| Target allowlist | Only known artifact kinds become candidates |
| Risk tiers | safe / review / blocked; review requires extra confirmation |
| Quarantine-first | Default delete mode moves files aside; restore from Quarantine |
| Global caches | Opt-in at scan time; execute refuses if not enabled during scan |
| Path policy | Blocks system paths, IDE/Electron runtimes, user-configured protected paths |
| Scan-root guardrails | Warns before custom scans of global toolchain caches (v0.9.10+) |
Full product safety documentation: docs/product/safety.md.
- No telemetry — scans, paths, and file metadata are not uploaded to Deco servers.
- Optional online use — Settings → Check for updates fetches public GitHub Release metadata only when you trigger it manually.
- Open source — audit the desktop installer build and CLI package in this repository.
See also: README § Privacy & security.
Before recommending Deco to others or running cleanup on a new machine, verify:
- Scan roots — only developer project folders or selected volumes; not
%USERPROFILE%or drive roots unless intentional. - Custom scan mode — heed toolchain cache warnings (
.cargo, npm/pnpm stores); do not scan global stores unless you understand regeneration cost. - Review tier — read each row; type
DELETE REVIEWonly when you accept global cache or venv deletion. - Advanced / hard delete — leave disabled unless you explicitly need permanent deletion.
- Tool storage migration (Windows) — read Plan warnings; quit running apps; verify junction + destination before deleting backups.
- Quarantine retention — purge only after confirming restored paths work.
Detailed checklist: docs/product/safety.md.
Deco is not a substitute for:
- OS-level disk encryption or antivirus
- Backup software
- Sandboxing untrusted code
- General-purpose deletion of user Documents, photos, or email
The CLI (TypeScript) and desktop engine (Rust) share classification fixtures. Wire-format stability is governed by schema_version. Report classification bugs that could cause wrong-tier deletion as security-relevant.