Blinky is preparing its 1.0 release. Security reports are welcome for the current 1.0.x line, especially reports involving the privileged MagSafe helper, XPC authentication, AppleSMC writes, Accessibility content handling, or restoration after failure.

Please do not open a public issue for a suspected vulnerability. Use the repository's Security → Report a vulnerability action to start a private GitHub Security Advisory. Include the affected Blinky version, macOS version, Mac model, reproduction steps, and the security impact you observed.

Avoid including real notification content, credentials, signing certificates, or other personal data. A maintainer will acknowledge the report, reproduce it where possible, and coordinate disclosure after a fix is available.

The MagSafe helper is experimental. It accepts only signed Blinky clients from the helper's signing team and exposes only identity, protocol version, probe, session acquisition, three allowed ACLC LED values, session restoration, and controlled reload operations. It is not a general root shell, SMC tool, or charging controller.