Security

Report a vulnerability

A private address for security reports is coming soon and will be listed here. Until then, please don’t post vulnerabilities publicly.

When you report an issue, include the Serein and macOS versions and the steps to reproduce. Use synthetic accounts and data: don’t send real passwords, cookies, browsing history or working exploits against other people’s accounts. Please give us a reasonable chance to ship a fix before you disclose the issue publicly.

How Serein limits agents

• Each task reaches the browser through a short-lived capability over a private Unix socket. Stop revokes it immediately.
• Every task can read pages. Clicking and typing, your sign-ins, project edits and Mac actions stay off until you grant them.
• Isolated tasks use their own cookies. Your signed-in sessions are shared only with tasks you allow.
• Private windows are never shared with agents.
• Agents never receive the contents of password or payment fields, and tasks hand control back to you on password, payment and verification-code pages.
• Saved passwords live in the macOS Keychain behind device authentication, and Serein never submits sign-in forms on its own.
• A Mac action runs only after you review the exact script it proposes, and it is still subject to normal macOS permissions.
• Serein treats page content, imported files and project files as untrusted input.

Known limitations

The current build is signed with a Developer ID, notarized by Apple and runs with the hardened runtime, but does not use the App Sandbox. Agent command-line tools run under your own macOS account, with whatever restrictions you configure in each tool. Serein’s static checks on scripts add a layer of defense; they are not a general AppleScript sandbox.

Verify your download

The SHA-256 checksum of the current disk image is the sha256 value in release.json. To compare it with your copy, run this in Terminal:

shasum -a 256 ~/Downloads/Serein-*.dmg

If the two values differ, don’t open the file. Download it again from serein.pro.