Umai is a security tool; reports about Umai itself get first-class attention.

Please do not open a public issue for security problems.

• Preferred: GitHub private vulnerability reporting
• Or email: smtszk@gmail.com (subject: Umai security)

You can expect an acknowledgement within a few days and an assessment of severity and a fix timeline shortly after. Credit is given in the release notes unless you ask otherwise.

Anything that breaks Umai's own promises is in scope, for example:

• Getting Umai to execute attacker-controlled code (hostile lockfiles, manifests, launchd plists, MCP configs and advisory data are all untrusted inputs; the parsers are fuzz-tested, but bugs happen)
• Command injection through the Fix/copy-command paths
• Getting data about the user's machine to leave it (the app's core promise is that the package list and scan history never do)
• Tricking the signature/provenance checks into vouching for something they shouldn't

Only the latest release is supported. Umai checks GitHub for new releases (metadata only, once a day, can be disabled in Settings) so users hear about security fixes quickly.