Security & Privacy
This page covers what data the app accesses, where it stays, and how to report security issues.
Local-only operation
Section titled “Local-only operation”nfc-keyboard-emulator has no network access and sends no telemetry. It does not require an account. Everything the app does happens on your machine.
| Data | What happens to it |
|---|---|
| Card UID | Read from the reader; typed into the focused field; recorded in the in-memory scan log. Never sent off-device. |
| Settings | Stored in a local settings file. Never synced or uploaded. |
| Scan log | Held in memory while the app is running. Exported to a local CSV file only if you choose Export CSV. |
Read-only card access
Section titled “Read-only card access”The app reads the card UID by transmitting one APDU: FF CA 00 00 00 (get-data / get-UID). This is a read command. The app never issues a write command and never modifies any data on a card.
macOS Accessibility permission
Section titled “macOS Accessibility permission”To type into other apps, macOS requires the Accessibility permission (Privacy & Security → Accessibility). Granting this permission allows nfc-keyboard-emulator to synthesize keystrokes system-wide — it is the same permission used by any keyboard automation tool. The app uses this capability solely to type the scanned UID into the currently focused input field.
If you prefer not to grant Accessibility access, you can still use the app to read UIDs from the scan log or via CSV export without arming typing.
Vulnerability reporting
Section titled “Vulnerability reporting”Only the latest released version receives security fixes. Update to the most recent release before reporting.
Do not report security vulnerabilities through public GitHub issues.
Use GitHub’s private vulnerability reporting instead:
- Go to the Security advisories page.
- Click Report a vulnerability and fill in the details.
If you cannot use private reporting, email ich@dginx.de.
Include, where possible: a description of the issue and its impact, steps to reproduce or a proof of concept, and the affected version and operating system.
Reports are acknowledged within 5 business days. You will be kept informed as the issue is investigated, and credited in the release notes when a fix ships (unless you prefer to remain anonymous).
Areas of particular interest: the keystroke-injection path, the reader/worker boundary, and the release/signing pipeline.