Please do not open a public issue for a security vulnerability.

Use a private GitHub security advisory for this repository when available. Include:

• A clear description of the issue.
• Reproduction steps using temporary or synthetic files.
• The affected macOS and Tilly versions.
• The potential impact.

Do not include personal filenames, account names, private paths, or application data in reports.

Tilly is designed to be conservative:

• It moves files to Trash instead of permanently deleting them.
• It validates paths before deletion.
• It protects critical filesystem roots.
• It avoids privileged shell commands.
• It does not send filesystem paths or scan results over the network.
• Shared group containers are not selected automatically.
• Protected locations are inspected only when needed for the selected application.

If a discovery result appears unrelated, do not delete it. Report the path and association type using a synthetic example where possible.