Please report security issues privately, not in public issues or pull requests.

• Preferred: Open a private advisory report via GitHub Security Advisories — the Security → Report a vulnerability button on this repository (https://github.com/jankesec/macharden/security/advisories/new).
• Direct Contact: Reach out directly to security@jankesec.com.
• Encrypted Communication: If sending sensitive findings, encrypt using the author's PGP key:
  • PGP Fingerprint: FF0A 7D83 6751 CCE3 F9CC F574 FCF8 39FB 7F00 4626
  • GPG Key ID: 5FDB257F4AAE8C3F

Include enough detail to reproduce (macOS version, hardware architecture, affected check ID, command flags, and impact). You can expect an initial acknowledgement within 48 hours and coordinated disclosure of a fix. Please do not disclose publicly until a fix has been released.

Security fixes land on main and the latest tagged release.

macharden executes low-level system configuration audits, inspection of security daemons, and automated remediation commands. It is designed and provided for:

• Defensive hardening and compliance auditing of macOS endpoints you own or administer.
• Enterprise endpoint posture assessment and CIS / NIST / MITRE alignment.
• Security research, red/blue team emulation, and education.

Remediation commands (especially --fix with sudo) modify system settings. Always inspect scripts generated by --generate-fix or use --dry-run before applying changes in production fleets.

When reporting bugs or sharing output logs, never paste real secrets, plaintext credentials, or private internal IP addresses — use synthetic or masked values.