Skip to content

Security: hardychen-19/codex-macos-planner

Security

SECURITY.md

Security and privacy

Local-first boundary

  • Quiet Tasks data stays in /Users/Shared/QuietTasks/ by default.
  • The adapter does not send tasks, calendar data, or notes to a server.
  • Google Tasks integration is not enabled by this project.
  • Example files contain no user names, schedules, tokens, cookies, or absolute home-directory paths.

macOS permissions

Calendar and Reminders access is sensitive. Grant only the permissions required by EventKit. Never automate global TCC resets without an explicit explanation and confirmation.

Backups

Every adapter mutation copies the current task file into backups/ before an atomic replacement. Backups may contain private task titles and notes; do not commit or upload them.

Reporting a vulnerability

Open a GitHub security advisory or a minimal issue that does not contain private schedules, credentials, or task data.

Supported integration versions

  • mcp-server-apple-events: 1.5.0
  • ekctl: verified with 1.5.0
  • Quiet Tasks data model: v0.4.0

There aren't any published security advisories