Security, kept plain and reviewable.

MinkNote is a native Mac app built with a careful release process. Every release is checked through reviewed dependencies, Apple's App Store process, and Codex Security scanning.

Dependencies stay reviewable

MinkNote keeps its dependency surface small. Release builds use Swift Package Manager's resolved package file, so third-party Swift libraries are tied to specific versions and source commits when a release is prepared.

Before a library update ships, the change is reviewed deliberately: upstream release notes, source diffs, transitive dependencies, affected tests, and security scan results are all part of the release check.

MinkNote uses The Composable Architecture for predictable state management, explicit side effects, and testable feature logic. TCA is a widely adopted Swift library with more than 14k GitHub stars as of July 27, 2026. That public adoption is useful context, but it is not treated as a security guarantee; MinkNote still reviews dependency updates before release.

Editor code is bundled locally

MinkNote's rich Markdown editor is built with TOAST UI Editor, a mature open-source editor with more than 18k GitHub stars as of July 27, 2026.

The editor code is bundled with the app and loaded locally inside a WKWebView. MinkNote does not fetch the editor from a CDN at runtime, and the app source does not rely on a Node or npm runtime.

App Store review adds another layer

MinkNote is distributed through Apple's App Store process. Apple reviews apps and app updates against privacy, security, and safety requirements, including checks around sensitive data access.

MinkNote also uses macOS sandboxing and security-scoped access for user-selected folders. You choose where your notes live, and the app stores that permission using the standard macOS access model.

Useful Apple references:

• Apple App Review Guidelines
• About App Store security

Every release gets a security scan

Before each release, MinkNote runs a Codex Security scan on the repository and reviews any findings before shipping. Important dependency updates and release branches can also receive targeted diff scans.

Codex Security helps inspect source code, reason about the codebase's threat model, validate plausible vulnerabilities, and produce remediation guidance for human review. It does not replace manual judgment, but it gives each release a consistent security pass before it reaches users.

Useful Codex Security references:

• OpenAI Help Center: Codex Security
• Codex Security plugin quickstart