Use GitHub's private vulnerability reporting for suspected security issues. Do not place credentials, private service data, or machine-specific logs in a public issue.

ServiceShift is a graphical client for the system systemctl command. It does not implement systemd, PolicyKit, service supervision, privilege elevation, or unit-file parsing.

All systemctl arguments are constructed as an argument vector and executed without a shell. Scope, action, and unit names are validated against fixed allowlists before an action runs. ServiceShift never inserts sudo, never asks for an administrator password, and never attempts to bypass PolicyKit. KDE's registered PolicyKit agent may display the operating system's authentication dialog when systemd requires authorization.

Stop, Restart, and Disable require an explicit confirmation that shows the equivalent command. Start and Enable remain explicit button actions but do not receive an extra confirmation because they do not stop a running workload.

ServiceShift stores no settings or history. Closing it discards search text, scope, selection, service data, and action status.

• A permitted service action can still disrupt applications, networking, storage, or the desktop session. Confirmation is not a substitute for understanding the selected service.
• Enable and Disable affect future startup behavior but do not necessarily start or stop the current service.
• Systemd and PolicyKit remain responsible for authorization and execution.
• A compromised same-user process can inspect visible UI state and query most of the same service metadata directly.
• Service descriptions and errors originate in systemd and installed unit files. They are displayed as text and never interpreted as commands.
• ServiceShift does not edit unit files, create drop-ins, reload the systemd manager, or run arbitrary commands.