DELTREE processes scan and cleanup data locally and does not provide a network service. Direct Developer ID builds may retrieve a public Sparkle appcast and update archive over HTTPS.

Report vulnerabilities through GitHub private vulnerability reporting.

Do not open a public issue for an unpatched vulnerability or include private paths, Codex transcripts, signing material, or proprietary project data in a report. If private vulnerability reporting is temporarily unavailable, retain the report and retry later rather than disclosing it publicly.

Include the affected version or commit, macOS and Xcode versions, impact, reproduction steps, and the minimum redacted diagnostics needed to investigate. Maintainers will acknowledge reports as soon as practical and coordinate disclosure after a fix is available.

Security fixes target the latest published release, including the current prerelease candidate, and main; older prerelease builds may be asked to upgrade before investigation continues.

Please treat these as security-sensitive:

• cleanup execution
• Trash handling
• simulator delete/erase commands
• filesystem scanning scope
• local process inspection
• Codex task/session metadata parsing
• release signing and notarization
• Sparkle update signing and appcast generation

DELTREE should not upload paths, scan results, project names, Codex metadata, account data, or cleanup history.

Do not add analytics, crash reporting, network upload, or telemetry without explicit product review and a privacy update. Sparkle update checks are allowed only for Developer ID builds and must use signed update artifacts.