Skip to content

Security: baojia888/keylang-macos

Security

SECURITY.md

Security

Security Model

KeyLang is a local macOS helper that runs in the user's login session. It registers fixed global hotkeys and switches macOS input sources.

It does not:

  • install a keyboard event tap
  • request Accessibility permission
  • request Input Monitoring permission
  • read arbitrary keypresses
  • send network requests
  • run with elevated privileges

It does:

  • compile a Swift helper locally
  • create a background .app bundle in the repository directory
  • install a user LaunchAgent at ~/Library/LaunchAgents/io.github.keylang.keylang.plist
  • write logs to ~/Library/Logs/keylang.*.log

Review Checklist

Before installing, inspect:

  • Sources/KeyLang.swift
  • install-keylang.sh
  • uninstall-keylang.sh

The expected sensitive APIs are:

  • RegisterEventHotKey
  • TISSelectInputSource
  • CGEventSource.flagsState

CGEventSource.flagsState is used only to wait until shortcut modifier keys are released before changing input source. The project should not use CGEvent.tapCreate unless future maintainers explicitly document a broader permission model.

Reporting Security Issues

If you publish this repository, replace this section with your preferred private disclosure contact.

There aren't any published security advisories