Use GitHub private vulnerability reporting for suspected security vulnerabilities in this agent. Do not disclose vulnerabilities, credentials, pairing codes, tokens, or private billing records in public issues or pull requests.

Include the affected commit or app version, macOS version, impact, and minimal reproduction steps using synthetic data. Redact secrets and identifying account details from logs and screenshots; maintainers do not need your live credentials. If a credential has already been exposed, revoke or rotate it at its issuer rather than waiting for a response.

This repository covers the macOS agent only. The hosted Meterpop service and dashboard are not included. An agent source review cannot establish server-side retention, access controls, or operational security.

The agent stores provider secrets and its ingestion credential in macOS Keychain, while pairing and connection metadata is stored in local application-support files. Provider credentials authenticate direct provider requests. Sync exports billing amounts, source/connection identifiers, timestamps, and collection health metadata to the paired workspace. See README.md for details.

Provider keys may have capabilities beyond billing reads. Some Test and Sync operations incur provider charges. Check the required scope, destination workspace, and provider instructions before using real credentials. Keychain storage does not protect against every compromised-device or authorized-process scenario.

Removing a local connection or pairing is not equivalent to revoking remote access. Revoke provider keys at the provider and revoke the paired device in Meterpop workspace Connections as appropriate.

Public source enables inspection; it is not evidence of an independent audit, certification, or a guarantee that an existing distributed binary matches this tree. No certified reproducible-build claim is made. The default local build is ad-hoc signed and is not a notarized release. Release signing and notarization are separate from source-level security review.