SignalDesk currently distributes source code only. A locally built, ad-hoc signed app is not an official public binary release.

Please use GitHub Private Vulnerability Reporting. Do not open a public issue for an unpatched vulnerability.

Include:

• the affected commit or version;
• a concise impact description;
• reproducible steps or a minimal proof of concept;
• whether credentials, local files, Keychain items, OAuth callbacks, or external requests are involved;
• any suggested mitigation.

Never include a live API key, OAuth token, password, Cookie, TOTP seed, personal workspace, or unredacted account screenshot. Use synthetic values and remove third-party data.

The maintainer will make a best effort to acknowledge a complete report within five business days, validate it, coordinate a fix, and publish credit if the reporter wants it. Complex or third-party issues may take longer.

• OAuth and API credentials belong in macOS Keychain or the official Grok Build credential store, never in the repository or workspace JSON.
• The OAuth callback binds only to 127.0.0.1 on a fixed port and validates the in-memory authorization state.
• X writes require a current approved draft, an explicitly selected connected account, and a final user confirmation.
• SignalDesk does not support password/Cookie login, browser fingerprint spoofing, CAPTCHA bypass, proxy rotation, automatic bulk replies, or platform-enforcement evasion.
• External service content is untrusted input. A report that depends on social engineering or unsafe instructions in post content should say so explicitly.

GitHub Actions use minimum permissions and immutable full commit SHAs. Dependabot, dependency review, CodeQL, secret scanning, and push protection are part of the repository controls. Public binaries must additionally satisfy the release procedure.