Security

Last updated: October 29, 2026

Gapreel records screens, so we treat what it touches as sensitive by default. This page explains how the app protects your data and how to report a vulnerability.

How Gapreel protects your data

• Local first. Recordings, screenshots, clipboard history and settings stay on your Mac. Gapreel has no analytics or telemetry and needs no account.
• Secrets in the Keychain. Storage credentials, license keys and API keys you give Gapreel are stored in the macOS Keychain, not in plain files.
• Masking before anything leaves. Secrets such as private keys, JWTs, cloud keys and bearer tokens are masked in labels, screen text, diagnostics and transcripts, and URL query values are always removed. Share and demo exports blur secrets and personal data on screen.
• Encrypted offload. Recordings you offload to your own S3, R2 or B2 bucket or a synced folder are encrypted on your Mac with AES-256-GCM before upload.
• Agents ask first. Each AI agent that connects to Gapreel asks once in the Gapreel window. You choose what it may do, and you can revoke it in Settings at any time.
• Tamper-evident timelines. Every timeline line carries the hash of the line before it, so an edited, reordered or deleted line breaks the chain. Bundles are not signed yet.
• Signed releases. The app is signed with an Apple Developer ID and notarized by Apple. Updates are signed, and the app checks the signature before it installs one.
• Local daemon. The Gapreel daemon listens only on 127.0.0.1, so other computers on your network cannot reach it.

Report a vulnerability

Email [email protected]. Please include:

• what is affected (the Mac app, the browser extension or gapreel.com) and the version;
• the steps to reproduce it, and what an attacker gains;
• any proof-of-concept code or screenshots.

We confirm receipt within 3 business days, keep you updated while we fix it, and credit you in the release notes if you want.

Rules for testing

• Test only on your own Mac, your own accounts and your own data.
• Do not access, change or delete other people's data.
• Do not run denial-of-service, spam or social-engineering tests.
• Give us a reasonable time to fix the issue before you make it public.

We will not pursue legal action against research done in good faith under these rules.

Out of scope

• Problems that need an attacker who already controls your Mac or your macOS user account.
• Reports from automated scanners with no shown impact.
• Missing security headers on static pages that hold no user data.
• Vulnerabilities in Polar, Cloudflare or other third-party services. Please report those to the service.