Opsnook is developed on main, and fixes are applied there. Only the most recent release receives security fixes.

Please report vulnerabilities privately through GitHub's private vulnerability reporting: open the Security tab of the repository and choose Report a vulnerability. That channel is private to the maintainers until a fix is published.

Do not open a public issue for a security problem, and do not include real session content, prompts, tokens or absolute paths containing your username in the report. A minimal reproduction with redacted paths is enough.

Please include:

• the macOS version and the Opsnook version or commit;
• which agents were installed and which directories had been granted access;
• what an attacker could achieve, and the steps to reproduce it.

You can expect an acknowledgement within roughly a week. Because Opsnook is maintained by volunteers there is no guaranteed remediation deadline, but the report will be triaged and you will be told the outcome. Please give the maintainers a reasonable opportunity to publish a fix before disclosing publicly.

Opsnook parses files that other programs wrote, inside the App Sandbox, using directory access the user granted explicitly. The areas most worth scrutiny are:

• Parsers. Every adapter under Packages/OpsnookKit/Sources/OpsnookAdapters/ reads attacker-influenceable input: a session file is written by an AI agent acting on arbitrary prompts and arbitrary repository content. Anything a malformed or hostile session file can cause beyond a skipped record is in scope.
• The Claude approval path. ClaudeHooksInstaller and ClaudeHookRequestParser carry an approve or deny decision back to a running agent. A way to forge, replay or redirect a decision is in scope.
• File access. SecurityScopedBookmarkStore and AgentDirectoryAccess hold the user's granted directories. Reads outside the granted scope are in scope.
• Workspace git operations. GitWorkspaceService executes a real git binary. Argument injection, execution of an unexpected binary, or an operation the user did not trigger are all in scope.
• Data leaving the machine. Opsnook makes no network request other than a user-initiated git push. Any other outbound connection is a vulnerability, not a feature.

• The behaviour of the monitored agents themselves, and the contents of the session files they write.
• Anything requiring an attacker to already have local code execution as the user, or to have persuaded the user to grant directory access to a directory they control.
• Vulnerabilities in the App Sandbox, macOS, or in git, which belong to their respective vendors.