Security fixes are provided for the latest published release.

Use the repository's private security advisory feature. Do not open a public issue for a vulnerability before a fix is available.

Include:

• The affected 9x version and macOS version.
• Clear reproduction steps.
• The expected and observed behavior.
• Any proof-of-concept files needed to reproduce the issue.
• The security impact you believe is possible.

Do not include passwords, private documents, access tokens, or unrelated user data.

The maintainer should acknowledge a complete report within seven days. Release timing depends on severity and the complexity of a safe fix.

9x is a user-level helper. It is not designed to cross user accounts, modify system files, inject code, control applications through Accessibility, or force-terminate processes.

An application compatibility problem is usually not a security vulnerability. Unexpected quitting, privilege escalation, unintended data access, code execution, or bypass of the allowlist should be reported as security issues.

The primary GitHub archive is not signed with an Apple Developer ID and is not notarized. Verify both the published SHA-256 checksum and the GitHub artifact attestation before installing it. The attestation binds the archive digest to the repository and release workflow that built it.

The official Homebrew tap installs the same archive and requires its exact SHA-256 checksum. Homebrew simplifies verification but does not add Apple notarization.

An attestation is build provenance, not a malware scan or a guarantee that the source is safe. Users who do not want to approve an unsigned binary should build from the tagged source on their own Mac.