Security Policy
Supported versions
Viaduct is a rolling release. Only the latest published build receives security fixes. If you are running an older build, update before reporting an issue.
Reporting a vulnerability
Please do not open a public issue for security vulnerabilities. Report privately through one of:
- GitHub Security Advisories — open a draft advisory at the repository's advisories page (preferred).
-
Email —
support@magicelklabs.com
with subject
SECURITY: viaduct-app.
Please include:
- A description of the vulnerability and its impact.
- Steps to reproduce (a proof-of-concept if you have one).
- Affected version, macOS version, and any relevant configuration.
What to expect
- Acknowledgement within 5 business days.
- An assessment and, where confirmed, a fix timeline. Most issues are patched in the next release.
- Credit in the release notes once a fix ships, unless you ask to stay anonymous.
Please give a reasonable window to release a fix before any public disclosure.
Scope
Viaduct wraps the
@magicelk235/viaduct
command-line tool and can download extensions from the Chrome Web Store,
sign them with your local Apple identity, and self-update the bundled CLI
from npm. Reports touching any of these paths — CLI invocation, code
signing, the viaduct:// URL scheme, or the auto-update flow —
are in scope. Vulnerabilities in the upstream CLI package itself should be
reported against that package.