Please report security issues privately.

Preferred: use GitHub Security Advisories for this repository. If that is not available, open a confidential issue and clearly mark it as a security report. Please include:

• A description of the issue and potential impact
• Steps to reproduce
• Any relevant logs (redact secrets and personal data)

We will acknowledge receipt and work on a fix as quickly as possible.

Only the latest main branch is currently supported with security fixes.

• AppleScript execution: Calendar/Reminders integrations use AppleScript. Inputs are sanitized to prevent script injection. Avoid pasting untrusted content into calendar/list names.
• Config & state files: Configuration and state are stored under ~/.config/schedyx/. Keep this directory private and avoid committing local config overrides to version control.
• Fixtures (mock mode): Fixtures should live under data/fixtures/ and contain only synthetic or non-sensitive data. Do not store real calendar or personal data in fixtures.
• Rate limiting: Calendar operations are rate limited to avoid unintended bulk updates.