Elevate handles privileged access: it signs in to Microsoft Entra, holds tokens in your keychain and activates PIM roles. Security reports are taken seriously — please report them privately.

Use GitHub's private reporting: Report a vulnerability. Private vulnerability reporting is enabled on this repository, so no email address is needed; if the form is unavailable to you, open a regular issue that only asks for a private channel, without details.

Please do not open a public issue for a vulnerability, and do not include real tokens, client ids, tenant ids or account names in the report — a redacted transcript is enough.

Include, as far as you can: what you did, what happened, what you expected, the Elevate version, and the macOS version.

Only the latest release is supported. Fixes ship in a new release; older versions receive no backports.

In scope, roughly in order of severity:

• Token handling — a token or refresh token leaking into logs, diagnostics, disk, the pasteboard or a network request it does not belong in.
• Keychain use — items stored too broadly, without the "this device only" protection, or readable by other applications when they should not be.
• Authentication and authorization flows — the loopback redirect listener, PKCE, MSAL integration, redirect-URI or state handling, tenant/account mix-ups.
• Anything that could escalate privileges or leak privileged access — activating a role the user is not eligible for, acting in the wrong tenant or as the wrong account, or exposing which roles and approvals a user holds.
• The release and distribution path — the workflow, the DMG, the Homebrew cask.

Out of scope: findings that require an already-compromised Mac or an attacker with your unlocked login keychain, behaviour of Microsoft's own services, Conditional Access policy decisions, and the fact that current releases are ad-hoc signed rather than notarized (a known, documented state — see docs/releasing.md).

• An acknowledgement within one week of the report.
• Updates as the fix progresses, and credit in the release notes and CHANGELOG.md if you would like it.
• Public disclosure once a fixed release is out.

There is no bug bounty: Elevate is an unfunded open-source project, so reports are rewarded with thanks and credit only.