Please report security issues privately rather than opening a public issue.

• Use GitHub's private vulnerability reporting for this repository.

Please include:

• A description of the issue and its impact.
• Steps to reproduce (a Copy Diagnostics export from Waves › Settings › Diagnostics is helpful and contains no audio samples, but review it first because it may include app/device names or identifiers, route and permission states, persistence/cleanup status, and bounded error text).
• Affected version and macOS version.

You can expect an acknowledgement within a few days. Please give a reasonable window to address the issue before any public disclosure.

Waves is a non-sandboxed utility that uses Core Audio process taps (which require audio-capture permission) and an opt-in waves:// URL automation scheme that is off by default. It also exposes an opt-in same-user control Unix socket (used by wavesctl and the Stream Deck plugin), and, in Wave Link compatibility mode, connects to Elgato Wave Link's loopback control WebSocket only after verifying the listener's code signature. Security reports touching audio capture, the URL scheme, the control socket, the Wave Link bridge and its signature gate, the login item, or local file handling are especially welcome.