Found a problem?
Tell us.

Reporting a vulnerability

Email security@macshield.app with what you found, the steps to reproduce it, the Mac Shield version and macOS version, and what an attacker could do with it. A real person reads every report and replies by email. We’ll keep you updated while we fix it, and credit you in the release notes if you’d like.

Please give us a reasonable time to fix an issue before you share it, test only against your own Mac and your own license, and don’t access other people’s data, disrupt our services or run automated scans against them. Payment card issues belong to Stripe’s own security program.

Our security contact is also published at /.well-known/security.txt.

In scope

• The Mac Shield app, its privileged helper and its update mechanism.
• The signed advisory feed.
• www.macshield.app, downloads.macshield.app and the licensing API behind /api/v1/.

How Mac Shield protects itself

• Signed and notarized. The app is signed with an Apple Developer ID and notarized by Apple.
• Signed updates. Updates are signed, and Mac Shield verifies each one before it’s installed.
• Signed advisories. The advisory feed is cryptographically signed, so nobody can slip in fake advisories along the way.
• Local by default. Scans run on your Mac and there is no telemetry. See exactly what leaves your Mac in the privacy policy.
• Read-only checks. Every check is read-only. Fixes go into a review list and nothing changes until you confirm.
• No accounts. Your license is a key, not a password, and the website holds no payment or signing secrets.