Security fixes land in the current release. Moped is a small project with a single maintainer, so older versions are not patched — please update to the latest release.

Please do not open a public issue for a security problem.

Use GitHub's private reporting instead: Report a vulnerability. If that is unavailable to you, open a normal issue saying only that you have a security report and asking for a private channel — no details.

Please include what you can:

• the Moped version (Moped ▸ About Moped) and your macOS version
• what an attacker can do, and what access they need to do it
• steps to reproduce, and a sample file if one is involved

You can expect an acknowledgement within about a week. Fixes are released as soon as practical, and I'm glad to credit you in the release notes unless you'd rather not be.

Moped is a sandboxed, offline text editor: no network access, no telemetry, no accounts. Reports that are in scope include anything that lets a crafted file escape the sandbox, execute code, read or write files outside what the user opened, or corrupt a file on save.

Out of scope: crashes or hangs on malformed or very large input with no further consequence. Those are ordinary bugs — please open a regular issue for them, they are still worth fixing.