Security fixes are applied to the latest published release and the main branch.

Please use GitHub’s private vulnerability reporting flow. Do not open a public issue with exploit details, private session data, credentials, prompts, project names, usernames, or absolute paths.

Include:

• the affected tokenScope version and macOS version;
• a minimal reproduction using synthetic or fully redacted data;
• the security impact and any known prerequisites;
• whether the issue affects an original read-only source, tokenScope’s local cache, packaging, or UI.

You should receive an initial response within seven days. A coordinated disclosure date will be agreed before details are made public.

Most parser and history issues are not security vulnerabilities, but their evidence can still expose local work. Public bug reports must use the smallest possible synthetic schema sample. Never attach a complete transcript or database.