01
Reporting a Vulnerability
Email support@riftwalker.dev with what you found, how to reproduce it, the app version, and what an attacker could do with it. Please do not open a public issue first, and do not test against anyone else's machine or data.
We aim to reply within three business days. We will tell you what we plan to do, and we will credit you in the release notes if you would like us to.
02
What Is in Scope
The Riftwalker app for macOS and the website at riftwalker.dev. Coding-agent CLIs, model providers, and anything else you connect are outside our scope: report those to the company that makes them.
03
What We Do
Release builds are signed with our Developer ID and notarized by Apple, so you can check where a download came from. The app runs locally and sends us no telemetry. Credentials stay on your machine, in the macOS keychain or the app's local configuration, and the app reaches only the providers you configure.
The one request to our own servers is the update check: the app fetches a small version file from downloads.riftwalker.dev, which reveals your IP address and user agent to the CDN that serves it and nothing about your work.
Agent runs execute commands with the permissions you grant them. That is the point of the tool, so grant narrowly: the app's permission settings are the boundary, and they are yours to set.
04
Contact
Security questions and reports: support@riftwalker.dev.
Stratford Meridian Labs LLC