Security fixes are handled for the latest public release of Mac Drag Scroll.

Current public release archives are Sparkle-signed and include GitHub build provenance. The app bundle is not Apple Developer ID signed or notarized, so the README documents the macOS first-launch bypass.

• Mac Drag Scroll runs locally and does not send telemetry, input history, document contents, or browsing activity to the project.
• Accessibility and Input Monitoring are required to observe the configured mouse trigger and emit scroll events. The app rejects trackpad/tablet input by default and marks synthetic events to prevent feedback loops.
• Ignored apps, trigger safety checks, permission loss, duplicate instances, and target-window changes fail closed by cancelling drag scrolling.
• Sparkle verifies update archives with the public EdDSA key bundled in the app. GitHub Releases also publish checksums and build provenance for independent verification.
• The freely distributed app is not Apple Developer ID signed or notarized. Users should treat the documented Finder Open bypass as a distribution tradeoff, not as equivalent to Apple notarization.

Mac Drag Scroll is an input convenience utility, not a security boundary. macOS can revoke its permissions at any time, and users can disable or quit the app from the menu bar.

The repository runs these free security checks:

• OpenSSF Scorecard: checks open-source security posture and publishes the public Scorecard badge.
• CodeQL: runs static analysis for Swift security issues.
• Gitleaks: scans pushes, pull requests, and weekly scheduled runs for committed secrets.
• Quality Gate: builds, tests, and validates release metadata on macOS.
• Swift fuzz harnesses: exercise preference-style parsers and normalization paths.

Scan results are advisory and do not replace manual review, but they help catch common repository, workflow, and secret-handling risks before release.

Scorecard checks that depend on external profile or badge-program metadata are documented in OpenSSF Scorecard Notes.

Please do not open a public issue for a suspected vulnerability.

Use GitHub's private vulnerability reporting if it is enabled for this repository. If that is not available, contact Martin Calander through martincalander.com with:

• A short description of the problem.
• Steps to reproduce it.
• The macOS version and Mac Drag Scroll version.
• Any relevant logs or screenshots.

You should receive a response after the report has been reviewed. Confirmed issues will be fixed and disclosed responsibly.

Do not include secrets, private Sparkle signing keys, Apple account material, or private crash reports in public issues or pull requests. Redact local paths, user names, and app-specific data when sharing diagnostics publicly.