Security

Report vulnerabilities privately, and understand exactly what Remige verifies before it runs or installs anything.

Reporting a vulnerability

Use GitHub’s private vulnerability reporting:

Open a private advisory →

Do not open a public issue for a suspected vulnerability. Include the affected component (app, CLI, installer, update feed, or release workflow), version, macOS version, reproduction steps, impact, and any suggested fix. Expect an acknowledgement within three business days; this is a small project and fixes are best effort. There is no bug bounty.

Scope

• Remige.app, the remige CLI, and install.sh.
• The update manifest at https://remige.app/latest.json and the app/CLI update path.
• The release workflow and published release assets.

Out of scope: vulnerabilities in Homebrew, npm, pnpm, Bun, the Mac App Store, Sparkle appcasts, or third-party apps that Remige only detects or invokes; social engineering; issues that require an already-compromised local account.

What the update path verifies

• The feed and assets must use HTTPS.
• The downloaded ZIP or CLI must match the SHA-256 and size from the release metadata.
• The app bundle’s version and identifier are checked before staging.
• The replacement is staged next to the old bundle and rolled back if the move fails.
• The CLI refuses to overwrite a Homebrew-managed binary.

The feed is currently not separately signed. If both the Vercel feed and the GitHub asset were compromised, integrity would depend on those origins; Developer ID signing and notarization will add an independent check. Report suspected tampering immediately.

Security posture

• No shell interpolation: package names and versions are passed as argv arrays.
• No sudo injection; package managers report their own elevation errors.
• Remote release notes are converted to plain text before display.
• No daemon, no account, no analytics in the app.

This page is also available as security.txt.