Help keep Lary safe.

Supported release

Security fixes are applied to the newest public version. Install only a notarized build obtained through the official HTTPS download page.

In scope

• The current Lary macOS application.
• This official Lary website and release feed.
• Issues that could expose private local data, bypass a permission boundary, execute unintended code, or compromise release integrity.

Good-faith research

You are authorized to test only systems and data you own or have explicit permission to use, provided you avoid privacy violations, service disruption, social engineering, physical attacks, denial of service, destructive actions, and automated traffic that harms availability. Stop and report if you encounter another person’s data. Do not exploit beyond what is needed to demonstrate impact.

Lary will not recommend legal action for research that follows this policy and applicable law. This is not permission to test Apple, Open-Meteo, email providers, carriers, or other third-party systems.

Report privately

Email larryaqua1@larryaqua.com with Lary security report in the subject.

1. Describe the affected version and component.
2. Provide concise reproduction steps and impact.
3. Remove journal, Mail, Calendar, Messages, Contacts, recovery, and location data.
4. Use Lary’s sanitized diagnostics only when needed.
5. Wait for acknowledgement before publishing details.

If attachments are necessary, send only the minimum proof required and remove personal data first.

Response goals

Target acknowledgement: 3 business days. Target triage: 10 business days. Remediation timing depends on severity and Apple notarization. Lary will coordinate a reasonable disclosure date after confirming a valid report.

Release integrity

Public builds use a Developer ID Application certificate, hardened runtime, Apple notarization, a stapled ticket, Gatekeeper assessment, and a SHA-256 checksum in the HTTPS release manifest. An ad-hoc signed development build is never labeled as a public release.