Masque is a hobby project; only the latest release receives security fixes.

Please report security issues privately using GitHub's Report a vulnerability (Security → Advisories). Please do not open a public issue for a vulnerability until it has been addressed.

I'll acknowledge reports within a few days on a best-effort basis (this is a hobby project, not a commercial product).

• Your Apple ID password is used only in Apple's SRP login handshake: it is sent only to Apple, never travels in plain text, and is never stored or transmitted to the developer.
• After sign-in, Masque stores only Apple's session cookies and two-factor trust token in your macOS Keychain, to avoid re-logging in each launch.
• It talks only to Apple's own hosts (idmsa.apple.com, setup.icloud.com, *-maildomainws.icloud.com) to authenticate and manage your Hide My Email addresses.
• It stores nothing else of note (only non-personal UI preferences) and contains no telemetry, analytics, crash reporting, or third-party network calls.

• The bundled OAuth widget key / client id is the public iCloud-web value; it is not a secret and grants nothing on its own.
• The iCloud endpoints it calls are private and undocumented and may change or disappear without notice. This is an unofficial tool — see the README and Terms.
• Because the app authenticates your Apple ID and can read/rewrite its stored session in your Keychain, only run builds you trust. Releases are Developer ID-signed and notarized, and building from source (the documented path) lets you audit exactly what runs.