Mora is under active development. Security fixes are applied to the latest release and the main branch.

If you discover a security vulnerability, please do not open a public issue.

Instead, report it privately:

• Use GitHub's private vulnerability reporting, or
• Email nomunyom@gmail.com with a description of the issue and steps to reproduce.

You can expect an acknowledgment within a few days. Please give us a reasonable window to investigate and fix the issue before any public disclosure.

Mora is designed to be local-only:

• Timer state, progress, and preferences are stored locally in macOS UserDefaults.
• There are no accounts, no cloud sync, no analytics, and no telemetry upload.
• Idle auto-pause uses local keyboard/mouse inactivity signals only.

Reports about data leaving the machine, or about the integrity of released DMG builds, are especially important to us.