herdr-bar talks only to local Herdr Unix sockets (~/.config/herdr/…). It does not open network listeners.
If you believe you have found a vulnerability, please do not open a public GitHub issue.
Email openalon via the address on github.com/openalon, or open a private report from this repository’s Security tab if GitHub private vulnerability reporting is enabled.
Include:
- herdr-bar version (tag or commit)
- macOS version
- What the issue allows (local data exposure, unexpected process control, …)
- Minimal steps to reproduce
Please give a reasonable window before public disclosure.