We currently support the following versions with security updates:
| Version | Supported |
|---|---|
| 1.0.x | ✅ |
We take security seriously. If you discover a security vulnerability in PhotoCropper, please follow these steps:
- DO NOT open a public issue
- Email the details to: [Your security contact email]
- Include the following information:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- Response Time: We aim to respond within 48 hours
- Updates: We'll keep you informed about the progress
- Credit: We'll acknowledge your contribution in the security advisory (unless you prefer to remain anonymous)
- We'll investigate the reported vulnerability
- Develop and test a fix
- Release a security patch
- Publish a security advisory
- Update affected users
When using PhotoCropper:
- Always download from official sources (GitHub releases)
- Verify checksums of downloaded files
- Keep external dependencies updated (jpegtran, exiftool)
- Run the app with appropriate sandbox permissions
- Be cautious when processing images from untrusted sources
PhotoCropper uses these external tools:
- jpegtran (jpeg-turbo): Install via Homebrew and keep updated
- exiftool: Install via Homebrew and keep updated
We recommend regularly updating these dependencies:
brew update
brew upgrade jpeg-turbo exiftool- External Process Execution: PhotoCropper executes external commands (jpegtran, exiftool) via
ProcessExecutor. These are validated and sanitized. - File Access: The app requires file system access to read and write images. It uses security-scoped resources for sandbox compatibility.
- Metadata Handling: EXIF/XMP metadata is processed using exiftool. Malformed metadata could potentially cause issues.
- We follow responsible disclosure principles
- Security vulnerabilities will be patched before public disclosure
- We'll coordinate release timing with the reporter
For security concerns, please contact:
Thank you for helping keep PhotoCropper secure!