If you discover a security vulnerability in this project, please report it responsibly using GitHub's private vulnerability reporting:

1. Do not open a public GitHub issue for security vulnerabilities
2. Use GitHub's private vulnerability reporting: https://github.com/mgradwohl/tasksmack/security/advisories/new

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial assessment: Within 1 week
• Resolution: Depends on severity and complexity

Reports about TaskSmack itself are in scope, and in particular about its privileged helpers: on Linux, tasksmack-helper (started through pkexec for a polkit action, installed by the .deb), and on Windows, TaskSmackHelper.exe (started elevated through UAC). Each helper serves only the TaskSmack that started it and answers a fixed set of requests.

• Sanitizers: ASan, UBSan and TSan run in CI on Linux; an MSan preset is also available.
• Static analysis: clang-tidy (warnings fail the build), CodeQL, OSV-Scanner, dependency review and OpenSSF Scorecard.
• Fuzzing: ClusterFuzzLite fuzzes the parsers and the helper's request protocol.
• Hardening: release builds use -fstack-protector-strong everywhere, plus _FORTIFY_SOURCE=2 and PIE on Linux. The Linux helper, which pkexec starts as root (it then serves as nobody with four capabilities), adds full RELRO with immediate binding, stack-clash protection, CET on x86-64 (the AArch64 helper is compiled for BTI/PAC, but the shipped aarch64 binary carries no BTI/PAC property note until #2786 is fixed), _FORTIFY_SOURCE=3 and libc++'s fast hardening mode, and at run time keeps only the four capabilities its requests need, with no_new_privs set; the Windows helper links with Control Flow Guard and CET shadow-stack compatibility. Debug builds use -ftrivial-auto-var-init=pattern to expose uninitialized variables.
• Dependencies: fetched with CMake FetchContent at pinned versions, and kept current by Renovate.
• CI: builds and tests on every pull request and push to main, plus nightly checks.
• Releases: every release asset is signed with Sigstore; see Verifying a Release.

See CONTRIBUTING.md for how dependencies are pinned and updated.