Security Policy
Supported versions
Viaduct is a rolling release. Only the latest published build receives security fixes. If you are running an older build, update before reporting an issue.
Reporting a vulnerability
Please do not open a public issue for security vulnerabilities. Report privately through one of:
- GitHub Security Advisories: open a draft advisory at the repository's advisories page (preferred).
-
Email:
support@magicelklabs.com
with subject
SECURITY: viaduct-app.
Please include:
- A description of the vulnerability and its impact.
- Steps to reproduce (a proof-of-concept if you have one).
- Affected version, macOS version, and any relevant configuration.
What to expect
- Acknowledgement within 5 business days.
- An assessment and, where confirmed, a fix timeline. Most issues are patched in the next release.
- Credit in the release notes once a fix ships, unless you ask to stay anonymous.
Please give a reasonable window to release a fix before any public disclosure.
Scope
Viaduct wraps the
@magicelk235/viaduct
command-line tool, which it downloads from npm and keeps up to date. It
can download extensions from the Chrome Web Store, sign them with your
local Apple identity, read extension settings from your Chromium browser
profiles, and update itself through Sparkle. Reports touching any of these
paths (CLI invocation, code signing, the viaduct:// URL scheme,
browser profile reads, or either update flow) are in scope. Vulnerabilities
in the upstream CLI package itself should be
reported against that package.