Security

Apara
Security.

Effective 26 September 2026. A program that runs Windows software has to be honest about risk. This is how Apara handles it.

The boundary, stated plainly

A Windows program running through Apara is not sandboxed. Its bottle keeps its files and settings separate from other programs, which makes it easy to reset or remove, but it is a convenience boundary, not a security boundary: the program can reach whatever your user account can reach. Run only software you trust, from sources you trust.

How Apara protects you

Fail closed. Every downloaded component is fetched over HTTPS and checked against a pinned SHA-256 hash. A mismatch stops the install and says why; there is no “continue anyway”.
Least privilege. The main application carries none of the risky macOS entitlements. The permissions a runtime needs are confined to one small helper, and the build fails if they ever appear anywhere else.
Deny by default. Apara is designed so that a bottle gets no access to your files beyond what it needs, anything more is an explicit, visible, revocable grant, and Full Disk Access is never required.
Profiles cannot run commands. Compatibility profiles are data checked against a strict schema; the format has no way to express a command.
Signed releases. Public releases will be signed with an Apple Developer ID and notarised by Apple, and updates will be signed separately and verified against a pinned key before they install.
Kernel anti-cheat is refused, not bypassed. Apara never attempts to defeat anti-cheat or copy protection.
Minimal data. No accounts, telemetry off by default, and nothing identifying in a report even when it is on. See the privacy policy.

This website

apara.dev is a static site served only over HTTPS, with HTTP Strict Transport Security, a strict Content Security Policy, and headers that stop it being framed by other sites or leaking the pages you visit to the sites you leave for. It has no logins, no forms that submit to our servers and no third-party scripts.

Reporting a vulnerability

If you believe you have found a security problem in Apara, Apara Mac Extender or apara.dev, please write to hello@apara.dev with the subject line “Security”. Include what you found, the steps to reproduce it, and the version or page affected. Please do not open a public issue or post details until we have had a chance to fix it.

We will acknowledge your report within five working days, keep you informed as we work on it, and credit you when the fix ships if you would like to be credited. We aim to fix serious issues within 90 days and will agree a disclosure date with you.

A machine-readable version of this contact is at /.well-known/security.txt.

Safe harbour

If you make a good-faith effort to follow this policy — you test only against your own installation or your own account, avoid privacy violations, data destruction and service disruption, do not access or keep other people’s data, and give us reasonable time to fix a problem before disclosing it — we will not pursue or support legal action against you for that research, and we consider it authorised.