Please report security problems privately through GitHub: open the repository's Security tab and choose Report a vulnerability (direct link). Do not open a public issue or pull request for them.

Include what is affected, how to reproduce it, and what an attacker could do with it. You should get a first reply within a week. Yardlet is maintained by one person, so a fix may take longer; you will hear how it is going.

• The Yardlet app for macOS, including its built-in MCP server, connectors, built-in browser and update path (Sparkle and https://yardlet.app/appcast.xml).
• The phone remote's relay at relay.yardlet.app (source in relay/).
• The release artifacts on GitHub Releases and the Homebrew cask.

Problems in the agent CLIs themselves (Codex, Claude Code and the others) belong to their own projects. If Yardlet makes such a problem worse, for example by passing something to an agent that it should not, that is in scope.

Only the latest release receives fixes. Yardlet updates itself, so a fix reaches installed copies through the normal update.