Knotchy exists to keep untrusted pages away from your Mac, so a security bug here is the worst kind of bug. If you find one, thank you.

Please report it privately: on this repository's Security tab, choose Report a vulnerability. Don't open a public issue for it.

Tell us what you found, how to reproduce it, and which versions of Knotchy and macOS you used. We'll reply within a few days, and we'll have a fix or a plan before anything is made public.

• A page in the VM reaching your Mac, your local network, or anything else the firewall should block
• Getting around a proxy or VPN route's kill switch
• Knotchy running code on the Mac, or installing anything other than Apple's pinned container package
• Proxy passwords or VPN keys leaking from the keychain or from the VM's secrets share

A page taking over the browser inside the VM is expected; that's what the VM is for. Escaping the VM is what counts.

Only the latest release gets fixes.