yapping's central claim is that your voice and your text never leave your machine. A bug that breaks that claim is a security bug, not a feature request, and it will be treated that way.

Use GitHub's private reporting on this repository: Security > Report a vulnerability. That opens a thread only the maintainer can see.

Please do not open a public issue for something exploitable before there is a fix. Expect a first response within 72 hours. If a fix is warranted it ships in the next release, and the advisory is published crediting you unless you would rather stay anonymous.

• Any path where audio, transcripts, or clipboard contents leave the machine without the user asking. The app should only ever reach your configured cleanup provider, GitHub for updates, and Hugging Face once for the speech model.
• Update integrity: an installer or update that is accepted without verification
• Local storage: history, stats, or transcripts written without owner-only permissions, or in a location other users can read
• Misuse of the input and accessibility grants beyond capturing your voice and pasting the result

• Bugs with no security impact; please file a normal issue
• Weaknesses in third-party models or servers you configure yourself, such as your own Ollama instance or a custom endpoint
• Attacks that require the attacker to already control your machine or account

Fixes land in the latest release. Older releases are not patched.