WallpaperMachine runs on your desktop, signs in to Steam and pixiv, plays wallpapers other people made and updates itself. If you find a way any of that can be turned against the person using it, please tell us privately first.

Use Report a vulnerability on the repository's Security tab. Only the maintainers see the report, and the fix and advisory are prepared with you there. If you can't use GitHub, email support@wallpapermachine.app with "Security" in the subject.

Please don't open a public issue, discussion or pull request about a vulnerability before a fix is released.

A useful report has:

• what an attacker can do, and what they need first: a wallpaper the user applies, a position on the network, a local account;
• steps or a proof of concept, with the app version (Settings → About) and your macOS version;
• for a wallpaper, its Workshop ID, or its files if it isn't published.

You'll hear back within a week. When the fix ships, the advisory credits you, unless you would rather stay anonymous.

Only the latest release gets security fixes. The app checks for new versions itself and offers Restart to Update; builds from source should follow main.

• The app, its lock-screen extension and its renderer, including how they handle a downloaded scene, video or web wallpaper: a wallpaper that reads or writes files, reaches the network or runs code beyond what the app means it to.
• The control panel: wallpaper titles, descriptions, property labels, Workshop or pixiv data that the panel shows as anything other than text (formatting, a link to a site it does not allow, an image from a host it does not allow), and the Steam and pixiv sign-in web views reaching beyond the sign-in page.
• Steam and pixiv sign-ins leaving the Mac, or becoming readable by other apps.
• The updater installing anything other than a release whose SHA-256 matches.
• Diagnostics reports that leak what they promise to replace: home folder paths, the Mac user name, Steam account names.
• This repository's release workflows and the files they publish.

• Steam, the Steam Workshop, pixiv and Wallpaper Engine themselves: report those to Valve, pixiv or Wallpaper Engine's developers.
• A wallpaper that is only offensive or misleading to look at: report it on the Workshop.
• The first-launch prompt from macOS: the download is signed but not yet notarized, as the README says.
• The website, wallpapermachine.app: email support@wallpapermachine.app.

Each release's disk image is built by GitHub Actions from a tagged commit and published with a SHA-256 checksum and a build provenance attestation. To check one came from this repository's workflow:

gh attestation verify WallpaperMachine-*-arm64.dmg --repo WallpaperMachine/WallpaperMachine