The cue-type team takes the security and integrity of our desktop application and its users very seriously.

Only the latest stable release and commits on the master / main branch receive active security updates and patches.

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability, issue, or potential exploit in cue-type, please report it privately:

1. GitHub Advisory (Preferred): Navigate to the Security Advisories tab in this repository and click "Report a vulnerability" to submit a private disclosure.
2. Alternative Contact: If you cannot use GitHub Advisories, please reach out via email to the project maintainer with the subject [SECURITY] cue-type vulnerability report.

To help us triage and resolve the issue quickly, please provide:

• A detailed description of the vulnerability and its potential impact.
• Step-by-step instructions or a minimal Proof of Concept (PoC) script.
• Your operating system version, Windows build (winver), and execution privilege level (Standard user vs. Administrator).
• Expected vs. actual behavior.

• Initial Acknowledgment: Within 48 hours of receipt.
• Triage and Assessment: Within 5 business days.
• Fix and Release: A patched release will be issued alongside a public Security Advisory crediting the reporter (unless anonymity is requested).

cue-type injects keystrokes via Windows SendInput APIs into target applications. By design:

• It respects Windows UIPI: standard processes cannot inject input into elevated (Administrator) windows without explicit matching privileges.
• cue-type detects UIPI elevation mismatches and informs the user rather than attempting privilege escalation.

• cue-type uses standard RegisterHotKey Win32 APIs rather than low-level global keyboard hooks (SetWindowsHookEx) to prevent keylogger heuristic triggers.
• Official binaries are built cleanly without executable packers (UPX) or obfuscators.

• All execution scripts (*.cue.json) run strictly locally on the user's machine.
• cue-type contains zero analytics, telemetry, or remote telemetry tracking.