TextFlow handles captured text, screen content, clipboard state, and provider credentials. Please report security issues privately.

Use GitHub's private vulnerability reporting flow from the repository's Security tab. Do not open a public issue with exploit details, credentials, captured text, screenshots, or diagnostic exports.

Include only the minimum information needed to reproduce the issue:

• Affected commit or version
• macOS and hardware version
• Impact and reproduction steps
• Whether the issue involves Keychain, clipboard restoration, screen capture, logs, network transport, or provider responses
• A redacted proof of concept when useful

Never include a real API key or another person's data.

The project treats the following as release-blocking:

• API keys or sensitive headers stored outside Keychain
• Complete captured text, translations, credentials, or authorization headers in logs
• OCR screenshots written to disk or uploaded
• Clipboard contents not restored after fallback capture
• TLS verification bypass or arbitrary remote HTTP
• Old asynchronous results overwriting a newer session

TextFlow accepts plain HTTP only for explicit localhost and 127.0.0.1 development endpoints.

TextFlow is currently a source-distributed v0.1 developer preview. Security fixes are applied to the latest commit on the default branch until versioned public releases are available.