EyeShield is an app that blocks all keyboard and mouse input during breaks on Windows and Linux (X11). That makes security bugs serious: a flaw in the native helper or the scheduler could lock a user out of their machine, or fail to release input when it should.

Do not open a public issue for security vulnerabilities. Please report them privately:

• Preferred: GitHub's private vulnerability reporting on this repository (Settings → Security → Vulnerability alerts → Report a vulnerability), or
• Email: sabbir505@gmail.com (expect a reply within 72 hours; if you don't get one, follow up — providers occasionally filter mail).

When reporting, please include:

1. Affected version(s) and platform(s)
2. Steps to reproduce (or a minimal PoC)
3. Impact — what a malicious actor could do
4. Suggested fix, if you have one

• Anything that lets a break fail to release input (user locked out)
• Bypassing the emergency override when the cap is exhausted
• Arbitrary code execution via the native helper protocol (JSON-over-stdio)
• Renderer compromise via IPC handlers (all IPC input is sanitized by settings-validator.ts — keep it that way)

1. Issue received and acknowledged within 72 hours.
2. Maintainer assesses severity and impact.
3. A fix is prepared and (if the issue is severe) a release is expedited.
4. Details are published after a fix ships, with credit to the reporter.

• The helper's stdout/stderr never carries secrets.
• Do not commit keys, tokens, or personal data — the repo is public.