| Version | Supported |
|---|---|
| Latest release | ✅ |
| Older releases | ❌ |
Only the latest release receives security fixes. Update to the latest version before reporting a vulnerability.
Please do not open a public GitHub issue for security vulnerabilities.
Report vulnerabilities privately via GitHub's private vulnerability reporting.
Include:
- A description of the vulnerability and its potential impact
- Steps to reproduce
- Any proof-of-concept code or screenshots (if applicable)
You can expect an initial response within 48 hours and a fix or mitigation plan within 7 days for confirmed issues.
| Data | Location | Notes |
|---|---|---|
| AWS session credentials | macOS Keychain (via keytar) | Never written to disk as plain text |
| IAM access keys | ~/.aws/credentials (standard AWS CLI location) |
Written by user request only |
| SSO tokens | AWS SDK default cache (~/.aws/sso/cache/) |
Managed by the AWS SDK |
| App lock password | ~/Library/Application Support/maws/settings.json |
PBKDF2-hashed (100k iterations, SHA-512, random salt) — never stored in plain text |
| Audit log | ~/Library/Application Support/maws/audit.log |
JSONL, no credentials stored |
- IPC allowlist — the renderer process can only invoke IPC channels with a known prefix (
auth:,settings:,features:, etc.). Unknown channels are blocked at the preload layer. - Webview navigation restriction — embedded AWS Console and CloudShell webviews are restricted to
*.amazonaws.com,*.aws.amazon.com,*.awsapps.com, andsignin.aws.amazon.com. Navigation to other domains is blocked and opened externally instead. - Single instance enforcement — only one instance of the app can run at a time, preventing IPC race conditions.
- No remote content in the main window — the main renderer loads local files only; navigation is blocked via
will-navigate. - App lock — optional Touch ID or password lock on launch and after a configurable idle timeout.
- No automatic updates — there is no auto-update mechanism. Users must manually download new releases.
- Audit log is local only — the audit log is not tamper-evident; a local attacker with file system access could modify it.
Dependencies are monitored by Dependabot with automatic PRs for updates. The CI pipeline runs npm audit --audit-level=high on every pull request — PRs that introduce high-severity CVEs will fail to merge.