MacTaskMan is currently pre-1.0. Security fixes are maintained on the latest
code in the main branch.
| Version | Supported |
|---|---|
main |
Yes |
| Older snapshots | No |
Please do not disclose suspected vulnerabilities in a public issue.
Use GitHub's private security advisory form and include:
- the affected file and code path;
- realistic prerequisites and impact;
- reproduction steps or a proof of concept when available;
- your suggested remediation.
You should receive an initial acknowledgement within seven days. Confirmed
issues will be fixed on main; disclosure timing will be coordinated with the
reporter when practical.
MacTaskMan is a local, unprivileged, read-only desktop application. It has no network service, account system, analytics upload, privileged helper, or automatic updater.
Security-sensitive boundaries include:
- native C and Swift buffer and resource ownership;
- local process, user, interface, and launch-item metadata;
- the optional user-enabled mactop executable and its output stream;
- exclusion of credentials and generated artifacts from the public repository.
The optional mactop provider is disabled by default. Enabling it executes the canonical path displayed in Settings. Provider input is treated as untrusted and bounded; failure must not stop native telemetry.
Reports that require an attacker to already control the signed-in user's shell or modify the source before compilation may be treated as defense-in-depth unless they demonstrate an additional privilege or trust-boundary violation.