BloomDisk is a filesystem tool that can delete files and folders. We take security seriously.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, email the maintainer or open a private security advisory on GitHub:

1. Go to the repository → Security → Report a vulnerability
2. Describe the issue, steps to reproduce, and potential impact

We aim to respond within 72 hours.

In scope:

• Unauthorized file deletion outside user intent
• Path traversal allowing deletion outside selected paths
• Command injection via API parameters
• Privilege escalation beyond documented admin prompts

Out of scope:

• macOS permission model limitations (Full Disk Access is required by design)
• User error when confirming permanent delete
• Issues in third-party dependencies (report upstream, but tell us too)

• BloomDisk runs locally only — no data is sent to the cloud.
• Protected system paths (/, /System, /Applications, your home root) cannot be deleted via the API.
• Always review items before permanent deletion.