Every script in this catalog runs on someone's Mac. If one of them can do harm — deletes or changes what it should not, sends data off the Mac, leaks the agent's token, runs code it downloads, or can be tricked into any of that by a file name, a window title or a song title — please tell us privately first.

How to report: the Security tab of this repository → Report a vulnerability. Name the template (widgets/<id>, apps/<id> or scenes/<id>), the file and the line, and what happens. Please do not post it publicly.

We read every report and answer as soon as we can. The fix lands in this repository and reaches the Gallery with the next signed release of the catalog, which agents download on their own. A button someone already added is their own copy and does not change by itself: to take the fix, add the button or page from the Gallery again.

Problems with the Desmaptic app or the agent themselves, rather than a template, go the same way; how they keep your Mac safe: https://desmaptic.com/security/