Last reviewed: 2026-08-14

EasyKey is a private-by-design macOS menu-bar utility. This page states the security stance, the supported scope for reports, and how to report a vulnerability. Technical analysis lives in the security section, not here.

• Typing transformation, macros, encoding conversion, settings, and on-device translation run entirely on the Mac; EasyKey collects no analytics or telemetry (README.md and data handling).
• The clipboard manager is off by default; optional persisted history is sealed with AES-GCM under a 256-bit key held in a device-only, non-synchronizing Keychain item.
• Cloud-translation credentials live in device-only, non-synchronizing Keychain items and never appear in settings files, logs, or exports.
• Cloud translation is strictly opt-in: source text leaves the Mac only from EasyKey translation surfaces, directly to the provider the user chose, after a first-use disclosure.
• Updates are distributed only through the Sparkle channel: HTTPS appcast plus EdDSA-signed archives (release guide).

The current release is 0.0.10, matching MARKETING_VERSION in the Xcode project and the version badge in README.md. There is no documented support window for older versions; treat the latest release as the supported one.

In scope for security review and reports:

• The EasyKey application, engine, and keyboard-service components.
• The login helper and the Sparkle update channel.
• Data handling and permissions as described in the security section.

Not authorized under any report or test: destructive testing, data exfiltration, denial-of-service of other users' machines, or social engineering of the maintainer or other users.

This repository publishes no issue template and no dedicated private reporting address; please report through the repository's issue tracker, marked as a security report so it is triaged as one.

What to include in a report:

• Steps to reproduce, with the app version (for example 0.0.10) and macOS version.
• What you believe the impact is, and which data or capability is affected.
• Any configuration that matters (permissions granted, providers configured, persistence enabled).

What not to do: do not probe in ways that go beyond reproducing the issue, do not exfiltrate data, and do not use social engineering.

No response-time commitment has been published, and this page makes none up. As a coordinated-disclosure default, we intend to acknowledge, assess, and address reports within a 90-day window, coordinating disclosure with the reporter before publicizing. No safe-harbor commitment has been published for this project.

• Security section — routes to the threat model, data handling, and platform permissions.
• Data handling — data flows, provider handling, and what stays on-device.
• Release guide — update channel security: HTTPS appcast and EdDSA signatures.