Multipaste is a clipboard manager — it observes everything you copy. That means security issues in it have an unusually high blast radius (passwords, tokens, private documents, half-typed Slack messages). I take security reports seriously and want them to land somewhere I'll see them quickly.

Multipaste is a sole-maintainer project (Rohin Agrawal). "Supported" here means I will investigate and fix critical security issues; it is not a guarantee of response time.

Email rohin.agrawal@gmail.com with "Multipaste security" in the subject. Do NOT open a public GitHub issue, do NOT post in Discussions, and do NOT mention it on social media until a fix has shipped.

Include:

• What's vulnerable (which version, which platform, which feature).
• How to reproduce it. The shortest reliable repro is ideal.
• What an attacker could do with it. Read your clipboard? Inject keystrokes? Crash the app? Read sensitive files? Privilege escalation?
• Whether you've disclosed this elsewhere yet.
• (Optional) How you'd like to be credited in the eventual fix CHANGELOG entry. Pseudonym is fine; anonymous is fine.

• Acknowledgment within 7 days. Often within 24 hours. If you don't hear back in 7 days, your email may have been filtered — try again or DM https://github.com/NewdlDewdl from a GitHub account for a nudge.
• Investigation and a working assessment within 30 days. Either "yes, confirmed, here's the plan" or "I couldn't reproduce, here's what I tried, do you have additional details."
• A patch release for confirmed critical issues as fast as I can build, sign, and ship a DMG. Multipaste releases are unblock-deploys-in-30-minutes scale, not enterprise-change-control scale.
• A public advisory posted to the repo (and the next CHANGELOG entry) once the fix has shipped, crediting the reporter (with permission) and describing the issue at the level of detail appropriate for users.

In scope:

• Bugs that allow reading or modifying the clipboard from outside Multipaste's intended interface.
• Bugs that violate the org.nspasteboard.org privacy markers (Multipaste should never persist ConcealedType / TransientType / AutoGeneratedType items — if it does, that's a security bug).
• Bugs that allow unauthorized access to the local history JSON (~/Library/Application Support/Multipaste/history.json) or preferences plist.
• Privilege-escalation bugs related to the Accessibility permission or the keyboard tap.
• Bugs that allow remote code execution via any pasteboard type Multipaste processes.
• Supply-chain issues with the release DMG, codesign requirements, or update-check path.
• Abuse of the --pin-current inter-process channel. Multipaste --pin-current posts a DistributedNotification (MultipasteIPC.pinCurrent) that the running app observes to pin the item currently on the clipboard. Any local process can post that notification, so a bug that let it do more than pin an already-present clip (inject content, read history, unpin an item, or bypass the org.nspasteboard.org concealed-clip skip) is in scope.

Out of scope:

• Multipaste reads the clipboard. That is the feature; the feature itself is not a vulnerability. If you're worried about a specific app whose contents you don't want captured, file the app under nspasteboard.org's privacy markers — Multipaste honors them.
• The local history.json is unencrypted by design. If your threat model includes "an attacker has filesystem access to my home directory," at-rest encryption of clipboard history won't save you; fix the underlying access. (That said, encryption-at-rest is a reasonable feature request — file it via the feature-request template.)
• macOS APIs Multipaste depends on (Accessibility, Carbon hot-key, NSPasteboard) are not in scope — report those to Apple.

(None yet. Be the first.)