docs: add a security policy (#795)

Co-authored-by: Jeffrey <9938813+Raphire@users.noreply.github.com>

.github/SECURITY.md

@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release and the current `master` branch are supported. Please verify that the issue exists in the [latest release](https://github.com/Raphire/Win11Debloat/releases/latest) before reporting it.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it privately through GitHub. **Do not open a public issue.**
+
+To submit a report:
+
+1. Go to the repository's [Security tab](https://github.com/Raphire/Win11Debloat/security).
+2. Select **Report a vulnerability**.
+3. Describe the issue, including the affected version, steps to reproduce, and potential security impact.
+
+Because Win11Debloat runs with administrator privileges, security issues that could allow unintended or unauthorized actions are considered in scope.
+
+This project is maintained by volunteers. Security reports are handled on a best-effort basis, without guaranteed response times.
+
+## What Is Not a Vulnerability
+
+- **Antivirus false positives:** Report these as regular issues.
+- **Intended functionality:** Changes such as removing apps or disabling telemetry are not security vulnerabilities. Report unexpected behavior as a regular issue.

Scripts/Features/Backup-RegistryState.ps1

@@ -4,7 +4,7 @@
 
     .DESCRIPTION
         Resolves selected and undo features from the provided keys, captures their
-        registry state, and saves the result under %LOCALAPPDATA%\Win11Debloat\Backups.
+        registry state, and saves the result as a JSON file in the Backups/ folder.
         Returns the file path on success, $null if no registry-backed features exist.
 
     .PARAMETER ActionableKeys
@@ -28,8 +28,13 @@ function New-RegistrySettingsBackup {
     }
 
     $timestamp = Get-Date
+    $backupDirectory = $script:RegistryBackupsPath
+    if (-not (Test-Path $backupDirectory)) {
+        New-Item -ItemType Directory -Path $backupDirectory -Force | Out-Null
+    }
+
     $backupFileName = 'Win11Debloat-RegistryBackup-{0}.json' -f $timestamp.ToString('yyyyMMdd_HHmmss')
-    $backupFilePath = Join-Path $script:RegistryBackupsPath $backupFileName
+    $backupFilePath = Join-Path $backupDirectory $backupFileName
 
     $backupConfig = Get-RegistryBackupPayload -SelectedFeatures $selectedFeatures -UndoFeatures $undoFeatures -CreatedAt $timestamp
     if (-not (Save-ToFile -Config $backupConfig -FilePath $backupFilePath -MaxDepth 25)) {

Scripts/FileIO/Save-ToFile.ps1

@@ -27,8 +27,6 @@ function Save-ToFile {
     )
 
     try {
-        $directory = Split-Path -Parent $FilePath
-        if ($directory) { [void][System.IO.Directory]::CreateDirectory($directory) }
         $Config | ConvertTo-Json -Depth $MaxDepth | Set-Content -Path $FilePath -Encoding UTF8 -ErrorAction Stop
         return $true
     }

Scripts/GUI/Show-MainWindow.ps1

@@ -98,7 +98,7 @@ function Show-MainWindow {
     $menuReportBug.Add_Click({ Start-Process "https://github.com/Raphire/Win11Debloat/issues" })
 
     $menuLogs.Add_Click({
-        $logsFolder = Split-Path -Parent $script:DefaultLogPath
+        $logsFolder = Join-Path (Split-Path (Split-Path $PSScriptRoot -Parent) -Parent) 'Logs'
         if (Test-Path $logsFolder) {
             Start-Process "explorer.exe" -ArgumentList $logsFolder
         }

Tests/Registry-BackupCreation.Tests.ps1

@@ -69,11 +69,11 @@ Describe 'New-RegistrySettingsBackup' {
         $script:RegistryBackupsPath = Join-Path $TestDrive 'Backups'
         $script:Features = @{ Feature = [PSCustomObject]@{ FeatureId = 'Feature'; RegistryKey = 'feature.reg' } }
         Mock Get-RegistryBackupPayload { @{ Version = '1.0' } }
+        Mock Save-ToFile { $true }
         Mock Write-Host {}
     }
 
     It 'returns null and does not write when no selected feature has registry data' {
-        Mock Save-ToFile { $true }
         $script:Features.Feature.RegistryKey = ''
 
         New-RegistrySettingsBackup -ActionableKeys @('Feature') | Should -BeNullOrEmpty
@@ -85,7 +85,7 @@ Describe 'New-RegistrySettingsBackup' {
 
         $result | Should -Match 'Win11Debloat-RegistryBackup-\d{8}_\d{6}\.json$'
         Test-Path -LiteralPath $script:RegistryBackupsPath | Should -BeTrue
-        (Get-Content -LiteralPath $result -Raw | ConvertFrom-Json).Version | Should -Be '1.0'
+        Should -Invoke Save-ToFile -Times 1 -Exactly -ParameterFilter { $FilePath -eq $result -and $MaxDepth -eq 25 }
     }
 
     It 'throws when persistence reports failure' {

Tests/Settings-And-Apps-FileIO.Tests.ps1

@@ -18,14 +18,6 @@ BeforeAll {
 }
 
 Describe 'Save-ToFile' {
-    It 'creates the destination directory on first use' {
-        $path = Join-Path $TestDrive 'UserData\LastUsedSettings.json'
-
-        Save-ToFile -Config @{ Setting = $true } -FilePath $path | Should -BeTrue
-
-        (Get-Content -LiteralPath $path -Raw | ConvertFrom-Json).Setting | Should -BeTrue
-    }
-
     It 'reports the write error and returns false when persistence fails' {
         Mock Set-Content { throw [System.IO.IOException]::new('Disk is full') }
         Mock Write-Error {}

Win11Debloat.ps1

@@ -174,21 +174,20 @@ if (-not $isAdmin) {
 # Define script-level variables & paths
 $script:Version = "2026.08.24"
 $configPath = Join-Path $PSScriptRoot 'Config'
-$script:UserDataPath = Join-Path $env:LOCALAPPDATA 'Win11Debloat'
-$script:LogsPath = Join-Path $script:UserDataPath 'Logs'
+$logsPath = Join-Path $PSScriptRoot 'Logs'
 $schemasPath = Join-Path $PSScriptRoot 'Schemas'
 $scriptsPath = Join-Path $PSScriptRoot 'Scripts'
 
 $script:AppsListFilePath = Join-Path $configPath 'Apps.json'
 $script:DefaultSettingsFilePath = Join-Path $configPath 'DefaultSettings.json'
 $script:FeaturesFilePath = Join-Path $configPath 'Features.json'
-$script:SavedSettingsFilePath = Join-Path $script:UserDataPath 'LastUsedSettings.json'
-$script:UiPreferencesFilePath = Join-Path $script:UserDataPath 'Preferences.json'
+$script:SavedSettingsFilePath = Join-Path $configPath 'LastUsedSettings.json'
+$script:UiPreferencesFilePath = Join-Path $env:LOCALAPPDATA 'Win11Debloat\Preferences.json'
 $script:LanguagesPath = Join-Path $configPath 'Languages'
 $script:DefaultLanguagePath = Join-Path $script:LanguagesPath 'en-US'
-$script:DefaultLogPath = Join-Path $script:LogsPath 'Win11Debloat.log'
+$script:DefaultLogPath = Join-Path $logsPath 'Win11Debloat.log'
 $script:RegfilesPath = Join-Path $PSScriptRoot 'Regfiles'
-$script:RegistryBackupsPath = Join-Path $script:UserDataPath 'Backups'
+$script:RegistryBackupsPath = Join-Path $PSScriptRoot 'Backups'
 $script:AssetsPath = Join-Path $PSScriptRoot 'Assets'
 $script:AppSelectionSchema = Join-Path $schemasPath 'AppSelectionWindow.xaml'
 $script:MainWindowSchema = Join-Path $schemasPath 'MainWindow.xaml'