bearwave-mac/SECURITY.md

Security Policy

Supported Versions

This repository is currently in an early alpha stage.

Security fixes are expected on:

• the current main branch
• the newest tagged pre-release, when one exists

Older snapshots may not receive backported fixes.

Reporting a Vulnerability

Please do not open a public issue for a suspected security problem before the maintainer has had a chance to assess it.

Preferred process:

1. Report the issue privately through your forge's private reporting workflow, if available.
2. If private reporting is not available, contact the maintainer through the repository owner profile first.
3. Include:
   • affected version or commit
   • reproduction steps
   • impact
   • any workaround, if known

Scope

Relevant security reports include:

• credential or token leakage
• unsafe network handling
• update or packaging integrity issues
• sandbox, entitlement, or macOS permission mistakes
• malicious or unintended code execution paths

Reports that are only stream-quality, broken station metadata, or ordinary playback bugs should go through the normal issue tracker.