Security Policy

Thank you for helping keep MacWinlink and its users safe.

Supported versions

MacWinlink is developed and distributed by the Amateur Radio Safety
Foundation, Inc. (ARSFI) as part of the
Winlink Global Radio Email service. MacWinlink comprises two
independently versioned applications that ship on separate release
cadences:

• MacWinlink (main app) — distributed via Apple's Mac App Store
  and TestFlight. Versioned 0.99.N during the public beta and
  1.0.0 and later at general availability.
• MacWinlink Helper — distributed as a signed and notarized
  disk image, installed alongside the main app. Versioned
  1.0.0-betaN during public beta and 1.0.0 and later at general
  availability. The Helper manages Wine, VARA, Direwolf, and other
  radio subprocesses that are architecturally incompatible with the
  Mac App Store sandbox.

Security fixes are applied to the current release of each
application only. Users are expected to update to the latest
released version.

Once MacWinlink reaches its 1.0.0 general availability release,
ARSFI will publish a formal product-lifetime statement describing
how long each major version will receive security updates. During
the public beta cycle, security updates ship in the next beta.

Reporting a vulnerability

Please do not report security vulnerabilities through public
forums, issue trackers, mailing lists, or social media.

Report privately by email to [SECURITY_EMAIL_PLACEHOLDER].

⚠️ Security reporting address is being provisioned.
The address above is a placeholder — the ARSFI security contact
address is currently being provisioned. Until this notice is
removed and a real address is in place, please file security
reports privately by opening a new discussion thread on the
Winlink Programs Google Group (private message the group
owners rather than posting publicly), and mark the subject line
[MacWinlink SECURITY]. We will update this document with the
permanent address as soon as it is live.

When the permanent address is in place, it will route to the
MacWinlink maintainer and a small, defined ARSFI escalation list.
Nothing else will route to that address; expect a human response,
not an automated reply.

Encrypted email will be welcome but not required. If you would
like to encrypt your report, request the current PGP key at the
same address and wait for the reply before sending the report
body.

When reporting, please include:

• A description of the vulnerability and the impact if exploited.
• Steps to reproduce, ideally with a proof-of-concept.
• Which application(s) are affected: MacWinlink main app, Helper,
  or both. Include specific versions tested.
• Your macOS version and hardware (Apple Silicon generation).
• Whether you have disclosed the issue to anyone else, and if so,
  who.
• Whether you would like to be publicly credited when the fix
  ships, and under what name.

Our response commitment

We aim to:

• Acknowledge receipt within 7 days.
• Provide a substantive response (accepted, rejected, needs more
  information) within 30 days.
• Ship a fix as fast as severity warrants:
• Critical (remote code execution, credential theft, or
  unauthorized station operation): worked immediately, out-of-
  cycle release if necessary.
• High (local privilege escalation, information disclosure of
  sensitive stored data): next beta cut.
• Medium / Low: next scheduled release.

For vulnerabilities that qualify as "actively exploited" or
"severe incidents" under the EU Cyber Resilience Act (Regulation
(EU) 2024/2847), Article 14 applies: ARSFI will issue an early
warning to ENISA within 24 hours of becoming aware, a notification
within 72 hours, and a final report within 14 days. This is handled
internally by ARSFI; reporters do not need to take any action beyond
the initial private report.

Scope

In scope:

• The MacWinlink main app (MacWinlink.app, bundle identifier
  org.arsfi.macwinlink).
• The MacWinlink Helper app (MacWinlink Helper.app, bundle
  identifier org.arsfi.macwinlink-helper).
• Distribution channel integrity of the above (App Store /
  TestFlight builds; signed and notarized Helper DMG artifacts).

Out of scope — please report to the appropriate upstream:

• VARA HF / VARA FM — proprietary; report to the VARA developer
  via https://rosmodem.wordpress.com.
• ardopcf (the bundled ARDOP modem) — report to
  https://github.com/pflarue/ardop.
• SmartSDR / DAX Audio — FlexRadio Systems; report via their
  support channels.
• Winlink protocol, Common Message Server (CMS), or RMS
  Relay — coordinate with the Winlink Development Team via
  ARSFI.
• Hamlib / rigctld — https://github.com/Hamlib/Hamlib.
• Wine (used to host VARA under macOS) —
  https://gitlab.winehq.org/wine/wine.
• Direwolf — https://github.com/wb2osz/direwolf.
• Any macOS system component — report to Apple via
  https://developer.apple.com/security-bounty/.

If you are unsure whether an issue is in scope, please report it
privately using the channels above and we will help you route it.

Non-security bug reports

For non-security bugs, feature requests, and general support:

• MacWinlink main app — use TestFlight's built-in
  Send Beta Feedback button. Reports include the TestFlight
  build number and route to the maintainer. This is the primary
  channel while MacWinlink is a TestFlight beta.
• MacWinlink Helper — file at
  https://github.com/jjones9527/macwinlink-releases/issues. Use
  the label app:helper.
• Cross-cutting (Bonjour pairing, Helper-to-main-app
  interaction) — either channel works; label with app:both
  if filing on GitHub.

Filing non-security issues through the security address above
slows both classes of report down.

Recognition

We are happy to publicly credit reporters in the release notes for
the release that ships the fix and in the security advisory
published on the MacWinlink downloads area. If you prefer to
remain anonymous or use a handle, please tell us when you report.

Coordinated disclosure

MacWinlink follows a coordinated-disclosure model:

• We work with the reporter to agree on a disclosure timeline.
• Default target: 90 days from initial report to public disclosure,
  adjustable by mutual agreement based on severity and complexity.
• We will not publicly disclose the vulnerability before a fix ships
  unless the reporter has independently done so, or unless we have
  strong evidence of active exploitation and public disclosure is
  the safer course.
• Once a fix ships, the corresponding advisory is published at
  https://downloads.winlink.org/User%20Programs/MacWinlink/ with the
  reporter credited (or attributed to "an anonymous reporter" if
  preferred).
• If a CVE identifier is warranted, ARSFI will request one from
  MITRE via the public CVE request form.