This project is alpha. Security fixes target the latest commit on main.
Please do not open a public issue for a vulnerability.
Email security reports to:
security@attainmentlabs.com
Include:
- A short description of the issue.
- Steps to reproduce.
- Whether credentials, account IDs, or live Apple Ads changes could be exposed.
- Suggested fix, if you have one.
The CLI is designed to avoid printing full credentials. It should also mask local profile IDs by default in diagnostics.
Do not commit:
- Apple Ads private keys
- OAuth tokens
- API tokens
- Env files
- Local credential paths
- Real account, app, campaign, ad group, or keyword IDs
Live Apple Ads writes should remain dry-run first and require an explicit apply flag.