Security

Found a security or privacy problem in Pesto? Please report it privately, not in public.

How to report

Email security@copypesto.net. It helps to include:

• the Pesto version and your macOS version,
• what you did, what you expected and what happened,
• whether it involves clips, the encryption key, backups or updates.

If you prefer, use private vulnerability reporting on GitHub.

What to expect

Pesto is free and has one maintainer. Every report is read, and you get an acknowledgement within seven days. There is no promised fix date: a confirmed problem is fixed in a release, and you are credited if you wish.

Please keep the report private until a fix is out, or for 90 days after you report it, whichever comes first. The full policy is in SECURITY.md.

How updates are protected

Pesto checks for updates over HTTPS and installs one only when you agree. Each update is signed, and Pesto verifies the signature before installing it. The signing key is kept on the maintainer’s Mac, not on a server.

Version 1.0.0 was not signed with an Apple Developer ID or notarized, which is why macOS asks you to confirm it the first time you open it. Updates are signed with Pesto’s own update key, a separate thing.

Security fixes go into the latest release only, so keep Pesto up to date.

What is and is not protected

The privacy page lists what is encrypted and what encryption does not protect.