Unspool has not published its first signed release. Security fixes currently target the latest commit on main.

This table will move to released version ranges when signed releases exist.

Do not disclose a suspected vulnerability in a public issue. When GitHub private vulnerability reporting is available, use Security → Report a vulnerability in this repository. Otherwise, use the private contact channel published by QenTerra and ask to open a private security advisory.

Include, when available:

• the affected commit or build;
• macOS and Xcode versions;
• reproduction steps and expected impact;
• whether the issue concerns TDLib authorization, Keychain, logging, Application Support data, security-scoped folders, path handling, conflicts, or downloaded files;
• a minimal synthetic test case.

Never include a real Telegram API hash, phone number, authorization code, two-step verification password, session database, private chat content, or personal download path. Replace them with synthetic values.

Reports will be acknowledged and assessed as soon as practical. Confirmed issues will be handled privately before coordinated disclosure when feasible. This project does not currently operate a bug-bounty program.

Unspool's security boundaries include:

• storing API credentials in macOS Keychain;
• maintaining an explicit sensitive-field redactor for TDLib diagnostic JSON;
• restricting native TDLib verbosity before any client or credential request is created;
• isolating unit-test application hosts from the live Keychain and Telegram session;
• keeping TDLib state and indexes in sandboxed Application Support;
• using security-scoped access for the selected destination;
• rejecting unsafe filenames and size mismatches;
• defaulting file conflicts to Skip;
• requiring explicit confirmation for replacement or copy naming;
• pinning TDLib and OpenSSL source inputs and validating the OpenSSL archive checksum during bootstrap.

These controls reduce risk but do not make arbitrary downloads trustworthy. Users should treat Telegram attachments like files from any other external source and scan or inspect them before opening.

If a report originates in TDLib, OpenSSL, an Apple framework, or a build tool, please still report the Unspool impact privately. The fix can require pinning a new upstream revision, changing integration behavior, or documenting that the issue is upstream.

See Dependencies and Third-party notices.