axterminator 0.9.1

macOS GUI testing framework with background testing, sub-millisecond element access, and self-healing locators
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

# Security Policy

## Supported Versions

| Version | Supported          |
|---------|--------------------|
| 0.6.x   | Yes                |
| 0.5.x   | Yes                |
| 0.4.x   | Yes                |
| < 0.4   | No                 |

## Reporting a Vulnerability

If you discover a security vulnerability in AXTerminator, please report it responsibly.

**Email**: mikko.parkkola@iki.fi

**Do not** open a public GitHub issue for security vulnerabilities.

### What to include

- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

### Timeline

- **48 hours**: Acknowledgement of your report
- **7 days**: Initial assessment and severity classification
- **30 days**: Fix developed and tested (for confirmed vulnerabilities)

### Scope

The following are in scope for security reports:

- **Accessibility API misuse**: Unintended access to UI elements outside the target application
- **Sandbox escapes**: Bypassing macOS security boundaries through the accessibility API
- **Credential handling**: Insecure storage or transmission of API keys (VLM backends)
- **Code injection**: Ability to execute arbitrary code through crafted element queries or recordings

### Out of Scope

- Denial of service against the local machine (macOS accessibility permissions already grant broad access)
- Issues requiring physical access to an unlocked machine with accessibility permissions already granted

## Acknowledgements

We appreciate responsible disclosure and will credit reporters in the changelog (unless anonymity is requested).