PingTray — Security Status
Vulnerability transparency for PingTray by sp33c.tech, published in line with the EU Cyber Resilience Act (CRA). Updated with every release scan.
PingTray security scan 2026-10-11 · 3 SBOMs (PingTray for macOS 1.4.0, PingTray for iPhone 1.4.0, Landing, API & MCP server) · 30 vulnerabilities fixed · 0 open in shipped code · status: Attention
No high or critical vulnerability affects shipped code. Remaining findings are limited to build-time tooling or are documented exceptions under review.
Components
| Component | Version | Packages in SBOM | Open, shipped code | Build-time only | Exceptions | Status |
|---|---|---|---|---|---|---|
| PingTray for macOS Mac App Store app (sandboxed, hardened runtime) |
1.4.0 | 0 0 runtime · 0 build-time |
0 | 0 | 0 | No known vulnerabilities |
| PingTray for iPhone iOS App Store app |
1.4.0 | 0 0 runtime · 0 build-time |
0 | 0 | 0 | No known vulnerabilities |
| Landing, API & MCP server AWS Lambda (Remix) + DynamoDB behind CloudFront, deployed with SST |
– | 704 100 runtime · 604 build-time |
0 | 68 | 3 | Attention |
“Runtime” packages ship with the product; “build-time” packages are only used to build or test it and never reach users. The macOS and iOS apps use Apple system frameworks only and have no third-party dependencies. Per-package details and the CycloneDX SBOMs are not published; they are available to customers, partners and market-surveillance authorities on request via the security contact below.
Reporting a vulnerability
- Security contact
- info@sp33c.tech (also in security.txt)
- Disclosure
- Report vulnerabilities by e-mail to the security contact. We acknowledge reports within 5 working days. Fixed vulnerabilities are reflected in the counts on this page once an update is available; details are shared with reporters, customers and authorities on request, not published. Please give us a reasonable time to fix before public disclosure.
- Security updates
- Security updates are delivered through the Mac App Store and the iOS App Store for the current release. Users on older releases should update to the latest version.
How this page is produced
For every component a CycloneDX 1.5 software bill of materials (SBOM) is generated from the pinned dependency lockfile or the Xcode project. Every package and version is checked against the OSV.dev vulnerability database (GitHub Security Advisories, CVE and npm advisories), and npm components are cross-checked with npm audit. Fixed vulnerabilities are counted by comparing this scan with the first recorded one. A machine-readable summary is in status.json.
Status meaning: No known vulnerabilities — nothing found; Attention — no high or critical issue in shipped code, remaining findings are confined to build-time tooling or are documented exceptions under review; Action required — a high or critical issue affects shipped code.