Only the latest release is supported. TaskbarOrbit is pre-1.0 and there are no maintenance branches.

TaskbarOrbit is a COM shell extension loaded in-process by explorer.exe, and its installer runs elevated to register that COM class. Two consequences worth stating plainly:

• Code that runs here runs with the privileges of the logged-in user's shell.
• A tampered release binary would be registered into the shell of everyone who installs it.

Release assets are built by GitHub Actions from a tag, never uploaded by hand, and every release includes SHA256SUMS.txt. Verify before installing:

Get-FileHash .\TaskbarOrbit-Setup.exe -Algorithm SHA256

The assembly is strong-named, which fixes its identity but is not an Authenticode signature — the installer is not code-signed, so Windows SmartScreen will warn on it. That is expected for now.

Please do not open a public issue for a security problem.

Use private vulnerability reporting, which notifies the maintainer privately and lets the fix be coordinated with a release.

This is a hobby project maintained by one person in their spare time. There is no guaranteed response time. If you have not heard back in two weeks, feel free to bump the advisory thread.

In scope:

• Anything that lets a non-administrator influence what the deskband loads or executes.
• Installer or uninstaller behaviour that leaves an exploitable state behind, such as a writable path being registered with RegAsm /codebase.
• Tampering with the release or build pipeline.

Out of scope:

• Explorer becoming unstable or failing to load. That is a bug, not a vulnerability — please open a normal issue. It is a known and documented risk of the deskband model; see the recovery section of the README.
• SmartScreen warnings caused by the installer not being code-signed.
• The registry locations used to enumerate virtual desktops being undocumented.