Security fixes are provided for the latest published release.

Please use GitHub's private vulnerability reporting feature for this repository. Do not include APNs device tokens, Apple account identifiers, signing certificates, provisioning profiles, or unredacted private CloudKit records in a public issue.

Include the affected version, platform, reproduction steps, and expected impact. You should receive an initial response within seven days.

Remote Mac Lock uses the current Apple account's private CloudKit database. Anyone who can run a correctly signed build with access to the configured container and that private database may be able to submit commands. A device ID prevents accidental cross-device execution but is not a cryptographic secret.

The Mac app accepts only fresh lock commands addressed to its configured device ID. It does not provide remote unlock or arbitrary command execution.