Use GitHub's private security advisory flow. Do not file a public issue.

Include:

• Affected version (ptah --version output)
• Reproduction steps
• Impact / threat model
• Suggested fix (if you have one)

We will acknowledge within 7 days and aim for a fix or mitigation within 30 days for high-severity issues.

ptah runs as a per-user macOS daemon with no network listener:

• IPC: UNIX socket at ~/.cache/ptah/sock, mode 0700. Only the owning user can connect. No authentication beyond filesystem perms.
• Persistence: SQLite file at ~/.cache/ptah/queue.db. Texts the user enqueued are stored in plaintext.
• Auto-start: launchd LaunchAgent runs as the user, no privilege escalation.
• Synthesis: in-process — espeak-ng (phonemization) + Kokoro via ONNX Runtime C API. User text reaches espeak-ng and the ONNX graph directly (no shell). The optional --engine say fallback passes text via argv to /usr/bin/say (no shell injection, but unvalidated text could exercise speech-engine bugs).
• Playback: rendered PCM is played via /usr/bin/afplay (macOS), invoked with a temp file path, no user text on the command line.
• Model: kokoro-v1.0.onnx (+ the pf_dora voice pack) is fetched over HTTPS by scripts/fetch-kokoro.sh from the onnx-community mirror. No checksum pinning yet (TODO).

• macOS itself (say, launchd, CoreAudio).
• Network attacks (no network listener).
• Vulnerabilities in voice models or upstream libpiper.
• Pre-auth scenarios where an attacker already has the user's filesystem access.

• Voice ONNX is not checksum-pinned (v1.1+).
• The Formula tarball URL/sha256 are placeholders until v1.0 release.
• launchd plist generator does not auto-inject PTAH_PIPER=1 — users patch manually.