Until the first public binary release, security fixes are applied to the main branch. After releases begin, only the latest published version will be supported unless a release note says otherwise.

Please report suspected vulnerabilities privately through GitHub Security Advisories. Do not open a public issue for an undisclosed vulnerability.

Include, when possible:

• the affected version or commit;
• reproduction steps and the expected impact;
• relevant logs, screenshots, or a minimal proof of concept;
• whether the issue has already been disclosed elsewhere.

This is a volunteer-maintained project with no guaranteed response SLA. The maintainer will acknowledge a valid report when available, investigate it, and coordinate disclosure before publishing a fix.

VoidBar does not expose a listening network service or operate a project backend. It does make outbound requests for weather, configured TickTick feeds, and allow-listed Spotify artwork. See PRIVACY.md for the complete network, storage, and permission map.

The TickTick iCal subscription URL may contain a secret token and is stored in macOS preferences. Reports involving exposed personal URLs, credentials, or other private data should be sanitized before sharing.

• Gatekeeper warnings caused solely by locally built, ad-hoc-signed binaries;
• vulnerabilities in macOS or a third-party service without a VoidBar-specific impact;
• social engineering, spam, denial-of-service testing, or destructive testing;
• reports produced only by automated scanners without a reproducible impact.