Perch is a native Win11 workspace for running coding agents (Claude Code first) across your projects. It spawns shell and agent processes and ships an in-app auto-updater, so the integrity of a release matters: an update installs and runs on a user's machine. We take reports seriously and appreciate responsible disclosure.

Only the latest released version is supported. Perch auto-updates from the GitHub Releases feed, so keeping the app current is the intended state. Fixes ship in a new release rather than as patches to older versions.

Please do not open a public issue for security problems.

Report privately through GitHub's private vulnerability reporting:

• Go to https://github.com/JosephIris/perch/security/advisories/new, or
• On the repo, open the Security tab and choose Report a vulnerability.

This opens a private channel visible only to the maintainer. If you cannot use that flow, contact the maintainer through their GitHub profile (https://github.com/JosephIris) and ask for a private channel before sharing details.

Please include, as far as you can:

• What the issue is and the impact you think it has.
• Steps to reproduce, or a proof of concept.
• The Perch version and Windows version you saw it on.

• Acknowledgement of your report, typically within a few days.
• An honest assessment of whether it's something we can fix and a rough timeline.
• Credit in the release notes when a fix ships, unless you'd rather stay anonymous.

This is a small, largely single-maintainer project, so responses are best-effort rather than bound by a formal SLA. Thank you for your patience.

Every tagged release carries a signed SLSA build-provenance attestation generated by the release workflow. You can verify that an installer you downloaded was built by this repository's CI, from this source, and was not tampered with:

gh attestation verify Perch-win-Setup.exe --repo JosephIris/perch

Authenticode code signing (so Windows SmartScreen and Defender recognize the publisher) is being onboarded via SignPath Foundation. Until that lands, releases are unsigned and Windows may warn about an unknown publisher on first run; provenance verification above is the interim integrity check. See docs/CODE-SIGNING.md for status.

• Perch spawns whatever shells and agent CLIs you run inside its panes. Issues in those third-party tools belong to their projects; issues in how Perch launches, sandboxes, or passes data to them belong here.
• See PRIVACY.md for exactly what Perch sends over the network.