Security
Last updated
We take security reports seriously and are grateful for them.
Reporting a vulnerability
If you believe you have found a security problem in the Squeaky app, on squeaky.site or in the licence service at api.squeaky.site, email [email protected] with “Security” in the subject line. Please include:
- what you found and where;
- steps to reproduce it;
- how we can reach you for questions.
We aim to confirm receipt within a few business days, keep you informed while we fix the problem, and credit you if you want. Please give us reasonable time to fix a problem before publishing it.
We ask that you do not access other people’s data, degrade the service, or use social engineering while testing. We will not take legal action against good-faith research that follows these rules.
We do not run a paid bug bounty programme at the moment.
security.txt
The same contact is published in machine-readable form at /.well-known/security.txt, following RFC 9116.
How Squeaky is built to be safe
- The app is signed with an Apple Developer ID and notarized by Apple.
- Your files never leave your Mac; scans and cleanups run locally.
- Cleanups move files to the Trash first, so you can check before anything is gone, unless you turn on “Empty Trash after cleaning” in Settings.
- Licence keys are tied to an anonymous machine hash, not to your Mac’s serial number.
- Sign-in links and codes expire after 15 minutes, and only hashes of them are stored.
- Updates are delivered through Sparkle with signed updates.