Security fixes are provided for the latest release and the main branch.

Use GitHub's private vulnerability reporting for this repository when it is available. Do not post exploit details, private system diagnostics, access tokens, or home-directory contents in a public issue.

Include:

• affected version and macOS version;
• a minimal reproduction;
• expected and observed impact;
• whether a system preference, login item, local file, or process is involved;
• any proposed mitigation.

The maintainer will acknowledge a complete report as soon as practical, validate the impact, and coordinate disclosure after a fix is available.

The app is not sandboxed because it launches user-selected applications and uses command-line system tools for user-domain preferences. It requests no root privileges, installs no privileged helper, opens no listening socket, and sends no telemetry. All managed writes are user-scoped.