Security

Do not open a public issue. Use private vulnerability reporting on the repository, or email security@dfacto.ai.

• Acknowledgement within 3 working days.
• Assessment within 10 working days, with a severity and target date.
• Disclosure is coordinated; we credit you unless you prefer otherwise.

• At rest: AES-256 via SQLCipher. The 256-bit key is generated from OS entropy and stored in the macOS Keychain, never beside the database. All tiers.
• Credentials: three layers — nspasteboard.org concealed markers, a password-manager bundle-id deny list, and content patterns. Detection fails closed.
• In the UI: a detected credential never crosses the IPC bridge in plaintext. The interface cannot leak what it never receives.
• On the network: nothing. yankd makes zero outbound connections, has no telemetry, and no crash reporting unless you opt in.
• In the journal: a credential is recorded as having existed, never with its content.

Stated plainly, because a security page that only lists strengths is marketing.

• Malware running as your user. It can read the system clipboard directly. yankd is not a defence against local code execution.
• Losing your Keychain entry. The vault becomes unreadable. That is the design: a recoverable key is a key an attacker can recover too.
• Physical access to an unlocked machine.
• Licence copying. Offline-verifiable tokens are inherently copyable; device limits are advisory.

Current gaps

The 0.1 build is not code-signed or notarised. That is tracked and gates the 1.0 release. Until then macOS will warn you, and that warning is correct.