• Default behavior is read-only. Real access requires NOTES_ALLOW_REAL=1, --notes and an exact folder allowlist. Real mutations additionally require both write gates.
• Locked notes are excluded. Shared notes are not editable; ordinary scoped reads can include shared notes. Use only folders you intend to expose.
• The code enforces scope; macOS Automation itself can grant broader access to Notes.
• Tool arguments cannot change accounts/allowlists, unlock notes, run scripts, supply local file paths for transfer, delete notes or share them.
• Treat all returned note and attachment content as untrusted data. Client models must not follow instructions found inside notes as commands or authorization.
• The stdio process implements no authentication or HTTP listener. Its launcher and client are trusted. Any remote transport must authenticate and isolate access.

Backups contain note text/HTML and metadata. They are owner-private but not encrypted by this package. Attachment temporary files are private and normally cleaned up; an interrupted process can leave artifacts for the owner to inspect locally. Neither files nor logs should be published. Keep code, configuration and backup ancestors protected from untrusted local modification. This is not a sandbox against a malicious user with the same OS identity.

A size limit on returned data is not a cap on Notes' memory or temporary disk usage. In particular, experimental exports may first materialize an entire attachment. No automatic deletion/pruning is performed on persistent backups.

Use the repository's private vulnerability reporting option if enabled. Otherwise, open an issue asking for a private contact without including exploit credentials, note text, account identifiers or private logs. Do not post real API keys, local configurations, backup files, or sensitive reproduction data in public issues.

Use minimal synthetic fixtures to reproduce problems. Read-only checks should be preferred before retrying an uncertain write. Notes has no atomic compare-and-swap, so simultaneous external edits can race with mutations despite version rechecks.