Security policy

Please report suspected security vulnerabilities privately. Do not include exploit details, credentials, private conversations, or personal information in public issues or discussions.

Reporting a vulnerability

Use Security → Report a vulnerability on the repository when that option is available. Include the OverTone version, macOS version, a description of the impact, and the steps needed to reproduce the problem. Use synthetic data where possible and remove secrets from attachments.

If private reporting is not available, open an issue asking the maintainer for a private security contact, without describing the vulnerability or posting sensitive attachments. Wait for a private channel before sharing the details.

The maintainer will assess the report and coordinate the response. There is no guaranteed response or resolution time. Please coordinate public disclosure with the maintainer.

For ordinary bugs, questions, and contributions, see the community guide.