Security fixes target the latest published release. Update earlier versions before reporting; mention if the problem also reproduces on current main. Packages are unsigned.
Report vulnerabilities through GitHub private vulnerability reporting, under Security → Report a vulnerability. Include the affected version/build, Windows version, impact, minimal reproduction and any relevant package/manifest. Redact personal paths and credentials. Do not put exploit details in public Issues or PRs. The maintainer will triage privately and coordinate a fix and disclosure. Ordinary UI bugs belong in Issues.
Layouts contain application names, paths and launch targets. Import only layouts you trust. Importing does not launch their targets or adopt startup, hook or credential settings.
Normal operation does not require elevation. Supported shell commands such as Run as administrator and Uninstall execute only after explicit user selection; preview mode disables them.
Update checks use the fixed public GitHub repository API without API keys or Authorization headers; API redirects are disabled. Explicitly requested downloads follow bounded HTTPS redirects among GitHub release hosts. Complete portable packages can be updated after a second, explicit restart confirmation: checksum, bounded ZIP extraction, manifest inventory, per-file hashes, version and executable architecture are checked before replacement. A separate helper replaces only distribution-owned files, retains a durable rollback journal and requires successful app initialization before commit. It refuses modified packages and collisions with unrelated local files. Settings writes are deferred until startup acknowledgment. See updates for prerequisites, manual recovery and cache storage. SHA-256 sidecars check integrity; they do not authenticate a compromised publisher account, and the distribution is not code-signed.
App lists, layouts and photo selections are not uploaded. ReStart no longer reads or stores release tokens and removes only its obsolete credential target without reading the value. There is no advertising or usage analytics. The optional diagnostic copy preview uses an explicit field whitelist rather than redacting raw logs. It excludes paths, account identifiers, app inventories, tile inputs, credentials, exception messages and stack traces. Nothing is uploaded automatically.
The optional Windows app-usage source reads only exact installed-app UserAssist identities and known executable/shortcut paths while Windows tracking policy permits it. It does not enumerate unrelated history values, change tracking settings or save imported observations. Most used exclusions apply to both sources. Clearing ReStart history does not erase Windows history.
Windows app tile compatibility is separate and disabled by default. It opens the current user's notification store read-only and selects only active tile/badge rows and their bound data for requested pinned package identities. Toasts and unrelated app payloads are not selected; no store backup or deleted-record recovery is performed. SQLite statements are read-only, parameterized, authorized against the required tables and bounded by row/byte/time limits. The store's private schema can change; failures restore ordinary icons. XML rejects DTDs/entities and becomes inert presentation data, never XAML, browser markup or code. Images are bounded raster files inside the owning package or its LocalState, with reparse/traversal checks and no network downloads. Notification contents and Windows usage are not passed to script tiles, logs, diagnostic copies or backups. SQLite can maintain shared reader-lock metadata, but no notification rows, registrations or privacy settings are changed.
Native settings discovery reads fixed Windows metadata and Control Panel identities, accepts documented settings URI identifiers and restricted namespace paths, and does not execute arbitrary metadata DeepLinks. Optional AQS queries use the Windows parser with a fixed local catalog/projection/result bound; content-disabled searches reject generated content predicates. The explicit Open Windows Search action invokes only the fixed Win+S shortcut after dismissing ReStart; it does not type query text, use the clipboard or evaluate a command. Windows then owns its online behavior.
ReStart script tiles have two execution paths. Native JSON/JS packages receive JSON through four bounded Jint worker processes, without CLR, Node, filesystem, networking, DOM or shell bridges. HTML/CSS packages run browser JavaScript in WebView2's sandboxed processes. They can use DOM, SVG and Canvas; they do not share Jint's CPU/memory limits. A three-second host reply deadline does not cap arbitrary browser script CPU use. Inspect every package before import.
A web tile gets a generated origin and in-memory package resources; the host does not map its local installation directory into the browser. Imports copy the manifest, required source files and bounded assets/, never host image/data bindings. Dynamic string compilation (eval, Function and constructor aliases) is disabled in Jint and blocked by the web tile Content Security Policy. External OS URI schemes are explicitly cancelled as well as navigation and downloads. These restrictions do not replace security updates to Jint, Windows and the Evergreen WebView2 Runtime. A Jint worker job limits resources and lifetime; it is not a reduced-privilege OS sandbox.
Direct web networking requires both a declared web.network capability and explicit per-tile user permission. It follows browser CORS/CSP rules, while browser permission requests, downloads, external navigation, dialogs and new windows are denied. No OS/filesystem/shell host objects are exposed. A selected slideshow image is intentionally available to that tile, including browser image processing; original paths are not passed. Optional aggregate metrics and configured response data are supplied as JSON. Tile Studio uses offline sample input and disables direct networking. See the tile guide for both boundaries, limits and storage.
Data-source access is opt-in per installed package. The host performs bounded GET requests over HTTPS or loopback HTTP, or reads an explicitly selected local file. At most four reads run concurrently, with eight-second deadlines, 256 KiB response limits, bounded JSON selection, XML DTD/entity rejection and retry backoff. Hiding Start cancels pending reads. Cookies and ambient credentials are disabled; redirects stay on the same origin. URLs, selected paths and optional credential headers are encrypted together with current-user Windows DPAPI in data-bindings.dat, separate from layout exports and imported packages. They are never added to script context; selected response values are. DPAPI does not defend against software already running as the same user. Review the data you select and trust the package receiving it.
Configured providers receive the request, its connection metadata and any explicitly configured URL parameters/credential header. No app inventory or layout is attached. The weather sample starts with Berlin coordinates and does not infer location. Provider terms and limits apply. Never publish personal connection settings or credentials in a shared manifest or JS file.
Explorer pin requests use bounded current-user-only IPC, validate filesystem targets and acknowledge after saving. Integration is per-user and reversible; Explorer is not patched and no DLL is injected. Startup is opt-in.
Local error logs contain only UTC time, a fixed error category and a numeric HRESULT. Exception messages, type names and stack traces are not recorded. Three generations of at most 64 KiB each are retained; writable legacy unstructured logs are removed on normal startup. Logging failures do not interrupt error handling. Logs are not uploaded automatically.
Private profile backups include app names, launch paths and custom source/assets. Saved connection credentials, photo-folder bindings, caches, logs and activity history are excluded. Browser networking permissions are revoked on restore, shell integration remains local, and fresh resource IDs prevent adoption of existing credentials. Archives have entry/size/path/hash checks and staged rollback. Review custom code/assets for embedded secrets before sharing any export. See backups.
Browser-process/renderer failures recreate affected tile controls with retained host state and queued input. Automatic recovery backs off and pauses a tile after three failures within two minutes; it is configurable, and Reload resets the budget. This limits repeated recovery, not arbitrary browser script CPU/memory use. Report bypasses of package/path/IPC bounds and unintended code execution privately.