Mila runs entirely on-device and requests sensitive macOS permissions (microphone, screen recording, accessibility), so we take security reports seriously.

Please do not open a public issue for security vulnerabilities.

Report privately via GitHub's private vulnerability reporting, or email uri@island.io. We aim to acknowledge reports within a few business days.

Please include:

• A description of the issue and its impact.
• Steps to reproduce, plus the Mila version (Mila → About Mila) and your macOS version.
• A proof-of-concept, if available.

Security fixes target the latest released version — please update to the newest release before reporting.

• Audio is transcribed locally; nothing is sent to a server.
• Optional LLM features shell out to a CLI you install and authenticate; Mila ships no API keys.
• Auto-updates are delivered via Sparkle using EdDSA-signed release artifacts.