← Spyglass

Security Policy

Last updated: October 9, 2026

Supported versions

Spyglass is a rolling release. Only the latest published build receives security fixes. If you are running an older build, update before reporting an issue.

Reporting a vulnerability

Please do not open a public issue for security vulnerabilities. Report privately through one of:

• GitHub Security Advisories: open a draft advisory at the repository's advisories page (preferred).
• Email: support@magicelklabs.com with subject SECURITY: spyglass.

Please include:

• A description of the vulnerability and its impact.
• Steps to reproduce (a proof-of-concept if you have one).
• Affected version, macOS version, and any relevant configuration.

What to expect

• Acknowledgement within 5 business days.
• An assessment and, where confirmed, a fix timeline. Most issues are patched in the next release.
• Credit in the release notes once a fix ships, unless you ask to stay anonymous.

Please give a reasonable window to release a fix before any public disclosure.

Scope

Spyglass is a menu-bar app with a Quick Look preview extension and a Finder thumbnail extension. The preview extension reads files on your Mac (Markdown, source code, notebooks, archives, SQLite databases, app bundles, binaries and more) to draw previews, and never uses the network to do it. On the Spyglass Drive plan, the app signs into Google (OAuth) with the read-only drive.readonly scope to fetch rendered previews of Google Drive files, and caches them only on your Mac. License keys are checked with Gumroad's license API. There is no Spyglass server.

In scope: files crafted to make a preview read, write or run something it shouldn't (a booby-trapped archive, database, notebook or binary, for example), credential handling, OAuth token storage, the Google client-secret configuration, license checks, and preview fetching. Do not include real secrets, tokens, license keys, or personal documents in a report. Redact them.