Skip to content

SECURITY.md

Latest commit

 

History

History
53 lines (36 loc) · 2.38 KB

SECURITY.md

File metadata and controls

53 lines (36 loc) · 2.38 KB
Raw

Security Policy

Zebra Label Tool is a small local desktop utility. Windows RAW printing is the primary outbound action, targeting a printer the user has already installed.

Network usage

The live preview feature optionally uses the Labelary API (api.labelary.com) to render label previews. This transmits your label content (text, barcode payloads, serial numbers) to a third-party service. If Labelary is unreachable, or if SSL certificate verification fails, the preview falls back to the local Pillow renderer — no data leaves your machine.

Labelary is a convenience feature. You can disable it by blocking api.labelary.com in your firewall; the tool will automatically use the local renderer.

ZPL injection hardening

User-provided text (label text, barcode payloads, sequence templates) is sanitized before embedding in ZPL ^FD fields. The characters ^ (caret) and ~ (tilde) — ZPL command prefixes — are stripped from text content to prevent command injection into printer firmware.

Supported versions

The latest commit on main is the supported version. There are no LTS branches.

Reporting

For non-sensitive security concerns, open a GitHub issue and mark the title with [security].

For sensitive reports (e.g. crash via crafted ZPL import file, path traversal in export, anything that could affect another user's system), please contact the maintainer privately on GitHub instead of opening a public issue.

What not to share in public issues

  • Private printer names, IPs, or shares
  • Internal hostnames, asset IDs, serial numbers
  • Customer or employee data inside label text
  • Generated ZPL with sensitive payloads (URLs, Wi-Fi credentials, internal links)

Redact before pasting. Replace identifiers with EXAMPLE-001 or similar.

Threat model (short)

  • The tool reads/writes local files: settings.json, exported .zpl, imported .zpl.
  • It calls Windows print spool APIs through pywin32.
  • It sends ZPL data to api.labelary.com for live preview rendering (HTTPS only, SSL certificate verification enforced — no unverified connections).
  • It does not auto-update.
  • The Tauri client uses WebView2 with a limited capability set defined in desktop/src-tauri/capabilities/default.json.

Out of scope: securing the printer itself, securing the user's Windows account, securing the network between the workstation and the printer.