Security

Last updated: [DATE]

We take the security of Soffio seriously. If you found a vulnerability, please tell us privately first, so we can fix it before others can use it.

Report a vulnerability

Email security@getsoffio.app. The same contact is in getsoffio.app/.well-known/security.txt.

Please include:

• what you found and what an attacker could do with it,
• the Soffio version (Settings > About) and your macOS version,
• steps to reproduce it, and a proof of concept if you have one.

Write in English or Italian. Please do not report security issues in public places such as social media or forums.

What happens next

We judge severity with CVSS and with how the issue affects real users. We keep you informed while we work on it and tell you when the fixed version is out. These are targets, not promises; we are a one-person company and will tell you if we need longer.

Coordinated disclosure

• Please give us 90 days from your report, or until a fix is out if sooner, before you publish details. If we need more time we will ask and explain why.
• If the issue is being actively exploited, we may publish an advisory sooner, together with you.
• When the fix is out, we publish a short advisory on getsoffio.app/security and mention it in the release notes. We will credit you by name or handle if you want; tell us how.
• We may ask for a CVE identifier for serious issues.

There is no paid bug bounty at this time.

Safe harbour

If you act in good faith and follow this policy, we will not take legal action against you for your research, and we will not ask anyone else to. Good faith means:

• you test only on your own Mac, your own accounts and your own data,
• you do not access, change or delete other people's data,
• you do not attack our website, Polar, Groq or other services in a way that harms them or their users (no denial of service, no spam, no social engineering),
• you give us reasonable time to fix the issue before you publish.

In scope

• The Soffio app, its soffio command line tool and its MCP server.
• The update feed and the update signatures.
• The licence handling inside the app.
• The website getsoffio.app.

Out of scope

• Services we do not run: Groq, Polar, Hugging Face, Ollama, yt-dlp, GitHub, our web host. Report those to their owners. We still want to hear if Soffio uses them in an unsafe way.
• Issues that need an attacker to already control your Mac user account with the same rights as you, or physical access to an unlocked Mac, unless Soffio makes things clearly worse.
• Bypassing the licence or trial on your own Mac. That is a licensing matter, not a security vulnerability. You can still tell us.
• Reports from automated scanners with no proof that the issue is real.
• Missing best-practice headers on the website with no real impact.

Support period

• Each major version of Soffio gets security fixes for at least 2 years after its first release, and for at least 1 year after the next major version comes out, whichever is later.
• Fixes ship in the latest minor release of that major version (for example 1.4.2). Updates within a major version are free. Please keep Soffio up to date; automatic update checks are the easiest way.
• We announce the end of support for a major version at least 6 months before it ends, on getsoffio.app/security and in the app's release notes.
• Soffio supports the macOS versions listed on the download page. When we stop supporting an old macOS version, the last Soffio version for it is named in the release notes.

How fixes reach you

Updates are delivered by the app's built-in updater (Sparkle). Every update is signed with our own key, and the app checks the signature before it installs. The app itself is signed with an Apple Developer ID and notarized by Apple. Release notes say when an update contains a security fix.

Software bill of materials

Soffio uses a small number of open-source components. Their names, versions and licences are in the THIRD_PARTY_NOTICES file inside the app and in Settings > About > Acknowledgements. A machine-readable software bill of materials (SBOM) for each release is available on request at security@getsoffio.app.

Contact

security@getsoffio.app. Roberto Cinetto, [ADDRESS], [PROVINCE], Canada.

The same contact is in security.txt.