Security

Report it in private. Install the signed disk image.

Updated 14 November 2026. Only the latest public release is supported for security fixes.

LinkLite is a local menu-bar app. It talks to the USB dock it drives and, for updates only, to GitHub. It has no backend. Official releases are EdDSA-signed and signed with the maintainer’s Apple Developer ID, then notarized. Share that disk image. Do not share an ad-hoc build, and do not teach anyone to bypass Gatekeeper.

Report a vulnerability

Use GitHub private vulnerability reporting. Do not open a public issue for a security report. Include the LinkLite version, macOS version, Mac model, dock model, and steps. The repository policy is SECURITY.md.

In scope: a path that captures a display or window other than the virtual displays LinkLite created, or that sends captured pixels anywhere other than the dock; misuse of the private virtual-display API that leaves stray displays; memory-safety or parsing bugs reachable from a malicious or malfunctioning USB device; anything that lets a modified build pass as an official one.

Out of scope: the dock’s own firmware, and the DisplayLink protocol design itself. Issues in upstream Vino that are not specific to LinkLite are best reported to Vino as well.

What to install

Install LinkLite 0.3.17 from this site or from the matching GitHub release. An ad-hoc build is a different app to macOS, so Gatekeeper and the Screen Recording grant do not carry over. The disk image’s SHA-256 is on the download page.

Boundaries that matter

• There is no App Sandbox. USB access and virtual displays make a sandbox impractical. Release builds enable the hardened runtime, with no JIT exception and no library-validation exception.
• There is no kernel extension and no privileged helper. Open at Login uses the ordinary login-item API.
• Screen Recording, once granted, lets the process read any display. LinkLite refuses to start a stream on the built-in display, or on a dock display that is mirroring it.
• A timing outside 480–5120 pixels on a side, or outside 1–240 Hz, is not programmed.
• The update feed is compiled in. A defaults write or configuration profile cannot redirect it. A download must be an HTTPS GitHub release disk image for this repository, within 64 MiB, and signed. Release notes are not fetched.
• HDCP checks possession of a key supplied by the receiver. It does not validate a receiver certificate. It is not a guarantee of the dock’s manufacturer. Connect only a dock you trust to receive the pixels on its monitors.