DITto security fixes are currently made on the main branch and released through the latest GitHub Release.

Please report security issues privately instead of opening a public issue.

Until a dedicated security contact is published, contact the repository owner on GitHub and include:

• DITto version / commit.
• macOS version and CPU architecture.
• Steps to reproduce.
• Whether the issue can cause data loss, unintended rename operations, or arbitrary file access.
• Any relevant manifest snippets or logs. Do not include private footage.

In scope:

• Bugs that can rename files outside the selected folders.
• Bugs that corrupt or lose rename/undo manifests.
• Bugs that bypass preview / conflict checks.
• Renderer-to-main IPC issues that expose unintended filesystem access.

Out of scope:

• Requests for destructive testing against third-party systems.
• Social engineering or physical access scenarios.
• Issues requiring a compromised local machine.

DITto is intentionally conservative:

• It only renames files.
• It does not remux media.
• It does not rewrite video streams or embedded metadata.
• It writes a manifest for undo after successful execution.