Snapcap records people's screens, cameras and microphones, so we take security reports seriously. Thank you for helping keep it safe.

Security fixes go into the latest release. Please check that you can reproduce the problem on the newest version before you report it.

Please don't open a public issue, discussion or pull request for a security problem.

Report it privately through GitHub's private vulnerability reporting:

1. Go to github.com/nftechie/snapcap/security/advisories/new, or open the repository's Security tab and click Report a vulnerability.
2. Describe the problem and include:
   • what an attacker could do, and what they need first (local access, a crafted file, a malicious network position, and so on)
   • steps to reproduce, or a proof of concept
   • the Snapcap version (Snapcap → About Snapcap), your macOS version, and how you installed it (Homebrew, install script, DMG, or from source)

Only the maintainers can see the report. We'll work with you on a fix in a private fork when needed.

• We aim to acknowledge your report within 7 days.
• We'll confirm whether it's a vulnerability, keep you posted on progress, and agree on a disclosure date with you. Most fixes should ship within 90 days.
• Once a fix is released, we publish a GitHub Security Advisory. We credit you there and in the changelog unless you'd rather stay anonymous.

Snapcap is a volunteer-run project with no bug bounty.

Snapcap has no servers, no accounts and no cloud storage. Everything runs on the user's Mac. We're most interested in:

• Capture boundaries. Recording more than the user selected, or continuing to capture the screen, camera, microphone or system audio after a recording is stopped or discarded.
• Data exposure. Recordings, project.json files or clipboard contents ending up somewhere the user didn't choose.
• Untrusted input. A crafted session folder, project.json or media file that causes code execution, or reads or writes outside its folder (including via rename).
• snapcap-cli, when it is pointed at untrusted files.
• Distribution. scripts/install.sh, the Homebrew cask, release artifacts, and the GitHub Actions workflows that build them (integrity, signing, supply chain).

Out of scope:

• How macOS privacy permissions (TCC) themselves work.
• Attacks that already require administrator access or a compromised account.
• The Gatekeeper warning on the un-notarized DMG. It's a known, documented limitation (see the README FAQ).