Security fixes go into the latest release only. Update to it from the Mac App Store, or with
brew upgrade --cask inputconfig for the Homebrew copy.
| Version | Supported |
|---|---|
| 1.6 | Yes |
| 1.5 and earlier | No |
Please report security issues privately, not in a public issue.
- Open the Security tab of this repository.
- Choose Report a vulnerability and describe the issue, the version, your macOS version, and the steps to reproduce it.
If you cannot use GitHub, reach out through ryleighnewman.com.
You can expect a first reply within 7 days. Confirmed issues are fixed in the next release, and the report is credited in the release notes unless you would rather stay anonymous.
InputConfig runs in the App Sandbox, collects no data, and makes no network requests of its own (see PRIVACY.md). Reports that are most useful include anything that lets a preset file, a MIDI or HID device, or another app make InputConfig send input it was not set up to send, or escape the sandbox.