Only the latest minor version is actively supported with security fixes.

If you discover a security vulnerability in Polpo Voice, please do not open a public GitHub issue. Email the maintainer privately at the address shown in the GitHub profile of @mattiacalastri, or use GitHub Security Advisories for private coordinated disclosure.

A response will be sent within 5 business days.

Polpo Voice is a single-user macOS desktop application. It does not run a network server, does not receive inbound connections, and stores no user data outside the macOS Keychain and the local runtime directory.

• One HTTPS GET to api.gumroad.com on launch (license verification, plain TLS, no payload beyond the license key)
• One HTTPS GET to api.elevenlabs.io periodically when the voice library is refreshed (no user data in the request)
• ElevenLabs TTS render calls — initiated by the user via the companion voice_briefing.py process, not by the app itself

• The license key in macOS Keychain Services (kSecClassGenericPassword, accessibility kSecAttrAccessibleAfterFirstUnlock)
• Window position and size in UserDefaults (autosave name PolpoVoicePanel)
• No telemetry, no usage logs, no cached transcripts beyond the file contract handled by the companion daemons

Only:

• com.apple.security.device.audio-input — to display microphone activity
• com.apple.security.automation.apple-events — to toggle the dictation engine via osascript

JIT and unsigned-executable-memory are explicitly disabled (false). No network entitlement is requested at the app layer because outbound HTTPS does not require one.

• Any compromise of the developer's Mac that grants the attacker arbitrary read/write to ~/.local/run/jarvis/ or ~/Library/Keychains/. At that point the threat model is the OS, not Polpo Voice.
• Vulnerabilities in macOS itself, in the Apple Speech Framework, in ElevenLabs' API, or in Gumroad's licensing platform.
• Vulnerabilities in the companion Python daemons that live outside this repo (stt_bar.py, jarvis_autosend.py, stop_tts_response.py).

None at the time of writing.