Security

Report a vulnerability privately

Use the private GitHub security advisory form. Do not put vulnerabilities, credentials, account details, typed content, or screenshots containing personal data in a public issue.

Include the affected version, operating system, impact, reproduction steps, and the smallest safe proof of concept. Remove tokens and unrelated personal information.

Security model

• Hosted routes verify identity, live desktop-session state, entitlements, quotas, and fixed-window rate limits.
• Electron keeps privileged provider credentials out of public desktop builds.
• Renderer-to-main IPC inputs are schema-validated and navigation is restricted to trusted application and authentication destinations.
• Active-field typing binds execution to the captured process and field, then stops on focus drift or operating-system rejection.
• A published macOS Community DMG contains a structurally verified, whole-bundle ad-hoc-signed app, is clearly disclosed as not Apple-notarized, and is paired with its SHA-256 checksum. Windows installers are published only when Authenticode verification passes.

Supported releases

Security fixes target the newest installer offered on the TypeFlow download page. Upgrade to the current version before reporting a problem that may already be resolved.

For macOS, use the checksum link beside the download to compare the DMG with the release's SHA-256 value before opening it. The checksum detects corruption; the app's ad-hoc signature seals its code but neither mechanism independently verifies TypeFlow's publisher identity through Apple.

TypeFlow does not currently operate a paid bug-bounty program. Good-faith research that avoids privacy violations, service disruption, and access to another person's data is welcome.

Other help

For installation or product problems that are not security-sensitive, use the support page.