| Version | Supported |
|---|---|
| 1.7.x | Yes |
| < 1.6 | No |
If you discover a security vulnerability, please report it responsibly:
- Do NOT open a public GitHub issue
- Email: kochj23 (via GitHub)
- Include: description, steps to reproduce, potential impact
We aim to respond within 48 hours and provide a fix within 7 days for critical issues.
- Shell Command Escaping: All rsync arguments properly escaped to prevent injection
- Plist Injection Prevention: Schedule/job plist values validated against injection
- Input Length Limits: Path and hostname inputs capped to prevent buffer abuse
- Hostname Validation: RFC-compliant regex validation for all hostnames
- Keychain Storage: Cloud AI API keys stored in macOS Keychain
- Thread Safety: Job execution state managed with proper synchronization
- No Sandbox: App runs without sandbox for full file system access (required for rsync)
- Never hardcode credentials or SSH keys
- Report suspicious behavior immediately
- Keep dependencies updated
- Review all code changes for security implications