# Security Policy Thank you for helping keep MacWinlink and its users safe. ## Supported versions MacWinlink is developed and distributed by the [Amateur Radio Safety Foundation, Inc. (ARSFI)](https://www.winlink.org/) as part of the Winlink Global Radio Email service. MacWinlink comprises two independently versioned applications that ship on separate release cadences: - **MacWinlink** (main app) — distributed via Apple's Mac App Store and TestFlight. Versioned `0.99.N` during the public beta and `1.0.0` and later at general availability. - **MacWinlink Helper** — distributed as a signed and notarized disk image, installed alongside the main app. Versioned `1.0.0-betaN` during public beta and `1.0.0` and later at general availability. The Helper manages Wine, VARA, Direwolf, and other radio subprocesses that are architecturally incompatible with the Mac App Store sandbox. Security fixes are applied to the current release of each application only. Users are expected to update to the latest released version. | Version | Supported | |---------|-----------| | Current released MacWinlink + Helper | ✅ | | Prior beta versions | ❌ — please upgrade | | Pre-beta releases (v0.9.x and earlier) | ❌ — please upgrade | Once MacWinlink reaches its 1.0.0 general availability release, ARSFI will publish a formal product-lifetime statement describing how long each major version will receive security updates. During the public beta cycle, security updates ship in the next beta. ## Reporting a vulnerability **Please do not report security vulnerabilities through public forums, issue trackers, mailing lists, or social media.** Report privately by email to `[SECURITY_EMAIL_PLACEHOLDER]`. > **⚠️ Security reporting address is being provisioned.** > The address above is a placeholder — the ARSFI security contact > address is currently being provisioned. Until this notice is > removed and a real address is in place, please file security > reports privately by opening a **new discussion thread on the > Winlink Programs Google Group** (private message the group > owners rather than posting publicly), and mark the subject line > `[MacWinlink SECURITY]`. We will update this document with the > permanent address as soon as it is live. When the permanent address is in place, it will route to the MacWinlink maintainer and a small, defined ARSFI escalation list. Nothing else will route to that address; expect a human response, not an automated reply. Encrypted email will be welcome but not required. If you would like to encrypt your report, request the current PGP key at the same address and wait for the reply before sending the report body. When reporting, please include: - A description of the vulnerability and the impact if exploited. - Steps to reproduce, ideally with a proof-of-concept. - Which application(s) are affected: MacWinlink main app, Helper, or both. Include specific versions tested. - Your macOS version and hardware (Apple Silicon generation). - Whether you have disclosed the issue to anyone else, and if so, who. - Whether you would like to be publicly credited when the fix ships, and under what name. ## Our response commitment We aim to: - Acknowledge receipt within **7 days**. - Provide a substantive response (accepted, rejected, needs more information) within **30 days**. - Ship a fix as fast as severity warrants: - **Critical** (remote code execution, credential theft, or unauthorized station operation): worked immediately, out-of- cycle release if necessary. - **High** (local privilege escalation, information disclosure of sensitive stored data): next beta cut. - **Medium / Low**: next scheduled release. For vulnerabilities that qualify as "actively exploited" or "severe incidents" under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), Article 14 applies: ARSFI will issue an early warning to ENISA within 24 hours of becoming aware, a notification within 72 hours, and a final report within 14 days. This is handled internally by ARSFI; reporters do not need to take any action beyond the initial private report. ## Scope **In scope:** - The MacWinlink main app (`MacWinlink.app`, bundle identifier `org.arsfi.macwinlink`). - The MacWinlink Helper app (`MacWinlink Helper.app`, bundle identifier `org.arsfi.macwinlink-helper`). - Distribution channel integrity of the above (App Store / TestFlight builds; signed and notarized Helper DMG artifacts). **Out of scope — please report to the appropriate upstream:** - **VARA HF / VARA FM** — proprietary; report to the VARA developer via . - **`ardopcf`** (the bundled ARDOP modem) — report to . - **SmartSDR / DAX Audio** — FlexRadio Systems; report via their support channels. - **Winlink protocol, Common Message Server (CMS), or RMS Relay** — coordinate with the Winlink Development Team via ARSFI. - **Hamlib / rigctld** — . - **Wine** (used to host VARA under macOS) — . - **Direwolf** — . - **Any macOS system component** — report to Apple via . If you are unsure whether an issue is in scope, please report it privately using the channels above and we will help you route it. ## Non-security bug reports For non-security bugs, feature requests, and general support: - **MacWinlink main app** — use TestFlight's built-in **Send Beta Feedback** button. Reports include the TestFlight build number and route to the maintainer. This is the primary channel while MacWinlink is a TestFlight beta. - **MacWinlink Helper** — file at . Use the label `app:helper`. - **Cross-cutting (Bonjour pairing, Helper-to-main-app interaction)** — either channel works; label with `app:both` if filing on GitHub. Filing non-security issues through the security address above slows both classes of report down. ## Recognition We are happy to publicly credit reporters in the release notes for the release that ships the fix and in the security advisory published on the MacWinlink downloads area. If you prefer to remain anonymous or use a handle, please tell us when you report. ## Coordinated disclosure MacWinlink follows a coordinated-disclosure model: - We work with the reporter to agree on a disclosure timeline. - Default target: 90 days from initial report to public disclosure, adjustable by mutual agreement based on severity and complexity. - We will not publicly disclose the vulnerability before a fix ships unless the reporter has independently done so, or unless we have strong evidence of active exploitation and public disclosure is the safer course. - Once a fix ships, the corresponding advisory is published at with the reporter credited (or attributed to "an anonymous reporter" if preferred). - If a CVE identifier is warranted, ARSFI will request one from MITRE via the public CVE request form.