Please report suspected vulnerabilities privately via GitHub's Report a vulnerability (Security → Advisories) on this repository rather than opening a public issue. You'll get an acknowledgment within a few days.

• DeskJig runs entirely locally; it requires no account and operates no server. Legacy account/cloud code paths still present during the open-source conversion are disabled and slated for removal.
• The app uses macOS Accessibility permissions to manage windows. Reports about Accessibility-permission escalation or misuse are especially welcome.