Nocturne is a menu bar utility. It requests no permissions, uses no private APIs, makes no network calls of its own, and stores nothing beyond a handful of preference values. That is a small surface on purpose, and it is the first thing to check if you are auditing this before you run it.

Do not open a public issue for a security problem.

Two private channels, either is fine:

1. Open a private advisory on this repository. This is preferred, since it keeps the report, the fix, and the disclosure in one place.
2. Email jack@dotcomjack.com with nocturne security in the subject.

What helps: the macOS version, the Nocturne version (shown in the menu), what you did, what happened, and a proof of concept if you have one. Partial reports are still welcome. A vague hunch that something looks wrong beats silence.

Response: this project is maintained by one person, so the honest commitment is an acknowledgement within 3 business days and a first assessment within 7. If a report is valid you will be credited in the advisory and the release notes unless you ask not to be.

Only the latest release gets fixes. There are no long term support branches.

Upgrade with brew upgrade --cask nocturne, or from the releases page.

• The Nocturne app itself, on a supported macOS version.
• The release and build scripts in scripts/ and build.sh.
• The Homebrew cask at dotcomjack/homebrew-tap.
• Anything that lets a Nocturne install run code it should not, read data it should not, or persist after the user removes it.

• macOS itself, and Apple's own menu bar behaviour.
• The absence of a hardened runtime feature that macOS does not offer to a sandboxed-optional menu bar agent.
• Reports generated by a scanner with no working proof of concept.
• Social engineering, and physical access to an unlocked Mac.

Every release is signed with a Developer ID certificate and notarized by Apple before it is published. You do not have to take that on faith. After mounting the DMG:

# Should print the Developer ID authority and Team ID PPL4MU9B6A
codesign -dv --verbose=4 /Applications/Nocturne.app

# Should print: accepted, source=Notarized Developer ID
spctl --assess --type execute --verbose /Applications/Nocturne.app

# Should print a valid ticket for the stapled notarization
xcrun stapler validate /Applications/Nocturne.app

Bundle identifier is com.dcj.nocturne and the Team ID is PPL4MU9B6A. If a copy of Nocturne reports anything else, it did not come from here. Report it through the channels above.

The whole app is about 1,000 lines of Swift in Sources/, with no third party dependencies to audit. ./build.sh produces a local unsigned build. Reading it end to end is a realistic afternoon, which is the point.