Security and vulnerability disclosure

How to report

E-mail security@watchmemory.app. English or Turkish is fine. Please include:

• the component and version (Mac app: WatchMemory → About; CLI: the tarball name, for example watchmemory-cli-0.3.0);
• steps to reproduce, and the impact you observed;
• whether you believe the issue is being actively exploited.

Please don't send real secrets or personal data. Use test values or WMCANARY_ canaries. If you need an encrypted channel, say so in your first message and we will set one up.

Scope

In scope:

• the WatchMemory Mac app;
• the CLI and scan engine (watchmemory, watchmemory-core), including the Android (beta) backend;
• the MCP server (watchmemory-mcp);
• the WatchMemoryDebugAgent Swift package;
• the GitHub Action and CI examples we publish, and the CLI download and checksum files;
• licence validation;
• watchmemory.app.

Accuracy problems are in scope too when they could make a gate pass that should fail, for example a secret that survives logout but is reported as released.

Out of scope: services we use but don't operate (Lemon Squeezy checkout, hosting, analytics; please report to them); social engineering and physical attacks; denial-of-service or volume testing against watchmemory.app; scanner output without a demonstrated impact; missing headers or e-mail records without a concrete attack; attacks that need an attacker who already controls your user account on the Mac.

Findings that WatchMemory reports in your own app are the product doing its job. For false positives or false negatives that don't affect a verdict, write to support@watchmemory.app.

What to expect

• Acknowledgement within 3 business days.
• An initial assessment within 10 business days.
• Updates at least every 14 days until the issue is fixed.
• Fix targets: critical issues within 30 days, high within 60 days, others within 90 days or the next release.
• A public advisory when the fix is available, crediting you if you wish.

We ask you to keep the details private until the advisory is published or 90 days after your report, whichever comes first. If a fix needs longer, we will agree an extension with you. WatchMemory is built by a small team: if we can't meet a target, we will tell you why.

We don't run a paid bug bounty yet.

Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorised. We will not pursue or support legal action against you for it, and that includes working around licence checks only as far as needed to demonstrate a vulnerability. If someone else brings legal action over research that followed this policy, we will say publicly that it was authorised.

In return, please:

• don't access, change or delete data that isn't yours, and stop as soon as you reach someone else's data;
• don't degrade our services or other users' experience;
• do only what is needed to prove the issue, and don't share or use licence keys obtained through a bypass;
• give us reasonable time to fix the issue before you disclose it.

This policy can't authorise testing of systems that belong to third parties. If you are unsure whether something is allowed, ask us first.

EU Cyber Resilience Act

We treat the WatchMemory Mac app, CLI and MCP server as products with digital elements under the EU Cyber Resilience Act (Regulation (EU) 2024/2847). Since 11 September 2026, Article 14 requires manufacturers to notify actively exploited vulnerabilities and severe incidents to the coordinating CSIRT and to ENISA through the single reporting platform: an early warning within 24 hours, a notification within 72 hours, then a final report.

If your report concerns active exploitation, put [EXPLOITED] at the start of the subject line so we can meet those deadlines. We will tell you before a notification includes details you sent us, and we won't share your identity without your consent unless the law requires it.

How WatchMemory handles your data

• Scans run locally. Captures and reports contain masked previews and keyed hashes, never raw values (unless you pass --show-values, which is refused in CI).
• Nothing is uploaded. The only network calls are the licence check and a daily update check that sends the version number.
• The CLI is published as a versioned tarball with a SHA-256 checksum. Pin both in CI.

Acknowledgments

No external reports yet. Researchers who report valid issues are listed here, with their permission.