Cascade runs locally on your Mac. It reads only the folders you point it at and launches only apps you already installed.

Please report security issues privately via GitHub's Report a vulnerability rather than a public issue. Include what the issue is, how to reproduce it, and the affected version/OS.

Relevant areas: file/path handling, launching external processes, and how launch commands are built.