Rekey reads the keyboard system-wide: it runs a global keyboard event tap and uses the Accessibility API to rewrite text in other apps. A flaw in software with that reach matters, so security reports are read first and taken seriously.
Please do not open a public issue. Report it privately instead:
Include the Rekey version (shown at the bottom of Rekey Settings), your macOS version, and the steps to reproduce. Private reports are answered before any public issue.
- Anything that lets typed text leave the Mac, or be read by another process through Rekey
- Rekey acting on input it should ignore — password fields, Secure Input, the lock screen
- Tampering with updates: the update feed, the download, or its signature check
- The data Rekey does send (see the privacy policy) carrying more than the policy says
Wrong corrections, missed words and crashes are ordinary bugs — use the Bug report template.
Only the latest beta receives fixes. Rekey updates itself, so that is the version to test.
There is no bug bounty.