Please don't open a public issue for a security problem.

Report it privately through GitHub's advisory form, or email hello@mapos.md.

Include what the issue is, how to reproduce it, and what an attacker could do with it. You'll get an acknowledgement within a few days. MapOS is maintained by one person, so please be patient on the fix timeline; you'll be kept in the loop, and credited in the advisory unless you'd rather not be.

Only the latest release gets fixes. MapOS is in beta and auto-updates by default, so please confirm the problem on the current version before reporting.

MapOS runs entirely on the user's machine, with no backend account system. The areas most worth looking at:

• The MCP server. It binds to 127.0.0.1 and is bearer-token gated. Anything that lets a page or another local process reach it without the token, or that widens the bind address, is in scope.
• Vault path confinement. Every agent tool resolves paths through vault-path.ts, which rejects .., absolute paths, and symlink escapes, and denylists .mapos/. A way to write outside the vault through any tool is in scope.
• The renderer sandbox. Context isolation, the preload bridge surface, and the session CSP policy. Anything that gets renderer-side content to execute in the main process is in scope.
• The auto-updater. Update artifacts are served over HTTPS and signature-checked by electron-updater. Anything that allows an unsigned or substituted update is in scope.
• Region packs. Downloaded artifacts are checksum-verified against the manifest. Path traversal during extraction, or accepting a pack that fails verification, is in scope.

Out of scope: anything requiring an attacker to already have local code execution as the user, since at that point the vault is plain files they can read anyway. Also out of scope: vulnerabilities in dependencies with no exploitable path in MapOS, and reports generated by a scanner with no demonstrated impact.