Report a vulnerability
This page is the reporting channel for security vulnerabilities in Truffle and on this website — in the sense of the EU Cyber Resilience Act. It says where a report goes, what helps, and what you can expect from us afterwards. The German version is authoritative; this English text is provided for convenience.
Contact: security@truffle-app.com
Please do not file public bug reports for security-relevant findings. A publicly described flaw can be used by anyone from the moment it is published — including those who never intended to report it.
What helps in a report
- What happens, and what you expected instead
- The steps that reproduce it
- Your Truffle version and macOS version
- Whether you were working with Apple Music, with local folders, or with a DJ program’s collection (rekordbox, Serato, Traktor)
A proof that the flaw can be exploited is welcome but not required. A report with gaps is better than no report.
What you can expect
- Acknowledgement within five working days.
- Initial assessment within ten working days — whether it reproduces and how severe it is.
- A corrected version according to severity; for actively exploitable flaws as fast as a build and Apple’s App Review take.
- A reply in every case — even if we do not classify the finding as a vulnerability, then with reasons.
Anyone who reports a vulnerability and gives us time to fix it will be credited in the release notes on request. Anyone who prefers to remain unnamed remains unnamed.
How a fix reaches you
A corrected version is published in the Mac App Store; reporters are notified. Your Mac installs it automatically or after your confirmation — depending on your macOS settings for app updates. Until then the old version keeps running.
Support period
The support period within the meaning of the EU Cyber Resilience Act is five years from the day a version was last offered for download, and applies from the first version published in the Mac App Store onwards. During this period reported vulnerabilities are handled within the time frames stated above and fixed versions are made available for download. Truffle is maintained as one line: security fixes are issued for the current version, older releases receive no backports — and the current version runs on the same systems as the one it replaces.
What Truffle does — and does not do
This belongs here because it describes the attack surface:
- No account, no server. There is nothing to sign in to and no server of ours: purchase, purchase verification and updates run through Apple’s Mac App Store. Truffle talks to us nowhere.
- Public catalogues are queried, plus Apple's audio recognition — without keys, without sign-in. What is transmitted is what is searched for: title, artist, album.
- Writing goes exclusively into your library — into Music.app via AppleScript, into local files via TagLib. Every change passes through a safety net it can be recovered from.
- Truffle executes no code you have not confirmed. Updates come exclusively through the Mac App Store, signed and reviewed by Apple; Truffle itself downloads nothing.
- The app runs in the App Sandbox. macOS asks you before Truffle can access folders of your choosing or Music.app; without your consent Truffle reaches no file.
A software bill of materials listing the bundled third-party components exists and is provided on request to the same address.
As of 15 September 2026