DraftThis page has not been reviewed by counsel. It describes the software accurately; it is not yet a legal instrument you should rely on.

Security

Not yet published · applies to Submergent 0.1.6

Reporting a vulnerability

Report security issues to to be published before release. Please include the affected version, what you did, and what happened. Do not open a public issue for a security report.

Supported versions

The current release is 0.1.6. Security fixes go to the current release, the one the Download button serves; there is no long-term support branch for 1.0.

How the app is distributed

Submergent is distributed as a Developer ID signed and notarized disk image. Verify the SHA-256 published on the download page before opening it, and check the signature with codesign --verify --deep --strict /Applications/Submergent.app.

Credentials

Provider API keys are stored in the macOS Keychain. Other application data is protected by macOS file permissions and is not separately encrypted by Submergent — enable FileVault to encrypt it at rest.

Agent execution

A session can run commands on your computer when you permit it. The Container environment runs those commands inside Docker or Podman, which changes where they execute but still mounts your workspace read and write — it is not a security boundary around your files.