OpenCutX is currently pre-1.0. Security fixes are applied to the latest development branch and the newest published release when releases begin. Older development snapshots are not supported.
Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability-reporting flow:
https://github.com/alan13367/OpenCutX/security/advisories/new
Include the affected revision, macOS version, reproduction steps, impact, and a minimal crafted library or media sample when safe to share. Remove personal media, credentials, security-scoped bookmarks, and private file paths. If a proof of concept may damage files or exhaust resources, describe the preconditions before attaching it.
You should receive an acknowledgement within seven days. Coordinated disclosure timing depends on severity, reproduction, affected releases, and the availability of a tested fix. Please allow maintainers a reasonable remediation window before public disclosure.
OpenCutX treats imported media, .ocxlibrary packages, render destinations, metadata, security-scoped bookmarks, and release artifacts as untrusted inputs. Particularly useful reports include:
- package traversal, symlink escape, or unsafe atomic-replacement behavior;
- crafted metadata causing memory exhaustion, crashes, or invariant bypass;
- unsafe codec/framework interaction reachable from an ordinary media import;
- export overwrites, partial-file confusion, or temporary-file leakage;
- stale security-scoped access or access beyond a user-selected location;
- command, pasteboard, drag/drop, or file-URL injection;
- signing, hardened-runtime, notarization, updater, or release-workflow compromise;
- secrets exposed through logs, diagnostics, crash reports, or repository history.
Core editing is local-first and requires no account or network service. Generated thumbnails, waveforms, and render caches are disposable and must never be required to reconstruct canonical project state.
Reports that only require a user to intentionally run a modified, unsigned build are generally out of scope unless the behavior also compromises official artifacts or other users. Unsupported codecs, expected performance limits, and public information in source code are not vulnerabilities by themselves.
Never test against another person's library, media, Mac, or account without explicit authorization.