Security Policy

Last updated:

We take security reports seriously and would rather hear about a problem early than read about it later. This page explains what is in scope, how to report, and what happens next.

Security reports
support@innesta.app, subject SECURITY
Everything else
support@innesta.app
Provider
See our Legal Notice

In scope

The distributed Innesta build for macOS and the licensing service behind it, including:

  • local repository handling and the Git operations the app runs;
  • the innesta command-line helper, the Quick Look extension, the Spotlight extension and its local catalogue, App Intents/Shortcuts, the Focus Filter, and the helpers shipped inside the app bundle;
  • use of the system git, GIT_ASKPASS, SSH_ASKPASS, and Keychain storage, including the licensing identifier and the local trial-revocation marker;
  • SSH host-key handling: how the authenticity prompt is parsed, how an approval is scoped to a single retry of one operation, and how changed or revoked keys are refused;
  • GitHub and GitLab OAuth, and the read-only loading of pull/merge requests, pipelines, stages, jobs, and job logs;
  • the AI commit-message integration for Apple Foundation Models, Claude Code CLI, and Codex CLI;
  • packaging, Developer ID signing, notarization, Sparkle updates, the update feed, the disk images, release notes, the release index, and the update supply chain;
  • the public licensing API: trials, activation, key replacement and rotation, refresh, deactivation, assisted device reset, and invitations;
  • Apple DeviceCheck trial admission, the single global claim lease, the fail-closed handling of an unavailable or ambiguous answer, and the rate limiter that guards token-bearing trial claims and assisted resets;
  • payment webhook verification and its idempotent processing;
  • licensing storage: activation slots, hashed keys and codes, the contextual keyed lookups derived from the installation identifier, and the normalized payment projections;
  • signing and verification of licence tokens;
  • the encrypted email outbox and its delivery integration;
  • the access-protected administration surface, its audited mutations, and the append-only audit log;
  • scheduled jobs, leases, and retries for webhooks and email;
  • the daily retention maintenance, legal holds, and the contact-blocking and service-closure workflows;
  • secrets, bindings, and the separation between the staging and production environments.

Out of scope

Unless the issue is caused by Innesta’s own integration:

  • vulnerabilities belonging to GitHub, GitLab, Bitbucket, Azure DevOps, Paddle, Cloudflare, Apple, Anthropic, OpenAI, git, SSH, or macOS themselves;
  • compromised credentials, or remote and SSH configurations controlled by third parties;
  • social engineering, phishing, spam, and trademark abuse;
  • testing against accounts, repositories, systems, or data that are not yours and that you are not authorized to test;
  • volumetric denial of service or the intentional degradation of third-party services.

How to report

Email support@innesta.app with the subject SECURITY and, where possible:

  • the component, environment, and version involved;
  • a description, the impact, and the minimum steps to reproduce;
  • a non-destructive proof of concept;
  • a request ID or timestamp, if the report concerns the backend;
  • logs or screenshots already stripped of keys, licence tokens, credentials, passphrases, repository content, and unnecessary personal data;
  • whether the issue has already been disclosed anywhere.

Please do not send licence keys, invitation codes, tokens, payment or infrastructure secrets, complete licence tokens, private keys, repository contents, or personal data that the report does not require.

What to expect

These are indicative targets, not a contractual commitment:

  • acknowledgement of receipt within 5 business days;
  • an initial assessment within 15 business days;
  • further updates at a reasonable cadence, depending on severity and complexity.

We may respond with a client hotfix, a server rollback, a mitigation, an advisory, or a coordinated rotation of secrets and keys. This policy does not promise a bug bounty; any reward would require separate terms agreed in advance.

Responsible disclosure

We ask you to test only systems that are yours or that you are authorized to test, to avoid modifying or exfiltrating data, to stop as soon as you encounter someone else’s data, and to give us a reasonable window to analyze and fix an issue before publishing details.

Nothing in this policy authorizes activity prohibited by law or by the terms of a third-party service.