TimeWarp — Security Status
Vulnerability transparency for TimeWarp by sp33c.tech, published in line with the EU Cyber Resilience Act (CRA). Updated with every release scan.
TimeWarp security scan 2026-10-11 · 3 SBOMs (TimeWarp for iPhone & iPad 1.12.1, Web app, API & website 1.0.0, TimeWarp for Mac (activity capture) 1.0.0) · 210 vulnerabilities fixed · 0 open in shipped code · status: Attention
No high or critical vulnerability affects shipped code. Remaining findings are limited to build-time tooling or are documented exceptions under review.
Components
| Component | Version | Packages in SBOM | Open, shipped code | Build-time only | Exceptions | Status |
|---|---|---|---|---|---|---|
| TimeWarp for iPhone & iPad iOS App Store app (Expo / React Native) |
1.12.1 | 529 187 runtime · 342 build-time |
0 | 0 | 2 | Attention |
| Web app, API & website AWS Lambda (Hono) behind CloudFront, DynamoDB, Cognito |
1.0.0 | 473 142 runtime · 331 build-time |
0 | 0 | 1 | No known vulnerabilities |
| TimeWarp for Mac (activity capture) Electron menu-bar app, built from source |
1.0.0 | 347 132 runtime · 215 build-time |
0 | 0 | 0 | No known vulnerabilities |
“Runtime” packages ship with the product; “build-time” packages are only used to build or test it and never reach users. For the iPhone app, the Expo CLI, the Metro bundler and the Xcode project generator run on the build machine only and are counted as build-time. Per-package details and the CycloneDX SBOMs are not published; they are available to customers, partners and market-surveillance authorities on request via the security contact below.
Reporting a vulnerability
- Security contact
- info@sp33c.tech (also in security.txt)
- Disclosure
- Report vulnerabilities by e-mail to the security contact. We acknowledge reports within 3 working days. Fixed vulnerabilities are reflected in the counts on this page once an update is available; details are shared with reporters, customers and authorities on request, not published. Please give us a reasonable time to fix before public disclosure.
- Security updates
- Security updates are delivered through the iOS App Store for the current release and are deployed continuously to the web app and API. Users on older app releases should update to the latest version.
How this page is produced
For every component a CycloneDX 1.5 software bill of materials (SBOM) is generated from the pinned dependency lockfile. Every package and version is checked against the OSV.dev vulnerability database (GitHub Security Advisories, CVE and npm advisories), and npm components are cross-checked with npm audit. Fixed vulnerabilities are counted by comparing this scan with the first recorded one. A machine-readable summary is in status.json.
Status meaning: No known vulnerabilities — nothing found; Attention — no high or critical issue in shipped code, remaining findings are confined to build-time tooling or are documented exceptions under review; Action required — a high or critical issue affects shipped code.