Only the latest release receives fixes.

Please do not open a public issue for a security problem.

Report it privately through GitHub's private vulnerability reporting, or by email to ofli61online@gmail.com.

Include what the problem allows an attacker to do, the steps to reproduce it, and the versions of Macro Studio, NVDA and Windows you tested on. You should get a first reply within seven days.

Macro Studio installs a low level keyboard hook, injects keystrokes with SendInput, and reads and writes files in your NVDA configuration folder. Reports that matter most:

• A crafted macro file or clipboard macro that causes code execution, an unbounded resource usage, or a write outside the configuration folder.
• A way to make the add-on inject keystrokes into an application its owner locked it away from.
• A way to make the recording hook capture or store keystrokes when recording is not running.

• The add-on records keystrokes on purpose while you are recording. That is the feature, not a flaw.
• Macros are stored unencrypted in your NVDA configuration folder, so anyone who can read that folder can read your macros. Do not record passwords.
• Anything requiring an attacker to already run code as your user.