macrecon is a security auditing tool. We ship fixes for the latest released version and the main branch.

The macrecon project takes security reports seriously. If you discover a vulnerability in macrecon itself (for example: a way to leak secrets in logs, an unsafe temp-file handling, or a bypass in the audit logic), please do not open a public GitHub issue.

Instead, report it privately:

1. Preferred: use GitHub's private vulnerability reporting at https://github.com/berodcdev/macrecon/security/advisories/new
2. Alternative: email 289769684+berodcdev@users.noreply.github.com with the subject [macrecon security] <short summary>.

Please include in your report:

• A clear description of the issue and its security impact.
• Steps to reproduce (commands, expected vs. actual behavior).
• The macrecon version (macrecon --version) and OS (sw_vers).
• Whether the issue affects the tool itself or the systems being audited.

• Acknowledgement: within 72 hours.
• Initial assessment: within 7 days.
• Fix or mitigation: target 30 days for high-severity issues, 90 days for low-severity. A CVE may be requested for high-severity findings.

In scope:

• Bugs in macrecon's own code (macrecon, lib/*.sh, profiles/*.sh).
• Secret leakage through logs, reports, or temp files.
• Unsafe filesystem operations (race conditions, symlink attacks).
• SARIF/JSON/HTML/Markdown report injection.

Out of scope:

• Findings on the systems macrecon scans (those are the tool's purpose).
• Vulnerabilities in dependencies that macrecon does not ship (it relies only on tools that ship with macOS: ssh-keygen, mdfind, security, lsof).
• Social engineering, physical attacks, denial of service on the host.

We follow coordinated disclosure. Once a fix is released, we credit the reporter in the advisory (unless they prefer to remain anonymous).

macrecon is designed for defensive security work: auditing your own systems, incident response, and authorized pentests. Running it against systems you do not own or have explicit permission to audit may be illegal. The authors are not responsible for misuse.