Security
How we protect Macloving, and how to report a vulnerability.
How we protect Macloving
- No passwords: sign-in uses Google or one-time codes.
- Private files: apps are stored privately and downloaded through signed links that expire after five minutes.
- Signed software: every app is signed with our Apple Developer ID and notarized by Apple; updates are also signed with a separate update key, so the app only installs updates we published.
- Signed licenses: membership confirmations sent to apps are digitally signed, so an app can tell if one was changed.
- Least privilege: team members only have the access their role needs, and every admin change is logged.
- Payments: card details are handled by Polar and never reach our servers.
Reporting a vulnerability
If you think you've found a security problem, please email security@macloving.app with the details and steps to reproduce. We'll acknowledge your report within 3 business days and keep you updated.
Please give us reasonable time to fix the problem before telling others, don't access or change other people's data, and don't run tests that disrupt the service (such as denial of service or spam). We won't take legal action against good-faith research that follows these guidelines.
Our machine-readable contact details are at /.well-known/security.txt.
Last updated: October 30, 2026.