Security fixes target MacPulse 7.0.x. Older protocol generations should not be considered interoperable or supported.

MacPulse has three independent trust domains:

1. the local macOS process/task manager;
2. the private-network paired management protocol;
3. the public HTTPS license service.

The license service is not a relay and receives no local management telemetry. The private-network agent accepts no arbitrary shell commands. Screen images never pass through the license service.

On a new endpoint, local-network discovery, the agent, background operation, process actions, system actions, administrator fallback, and screenshots are disabled. Local approval is enabled. Screen capture also requires a locally acknowledged policy and macOS permission.

• Stripe defines and owns the Price; the client cannot select the amount or features.
• Webhook signatures are verified from the unchanged raw request body.
• Payment is accepted only for payment_status=paid, mode=payment, 499 cents, and USD.
• Checkout activation secrets are random, stored only as SHA-256 hashes server-side, and bound to a pseudonymous installation identifier.
• Billing e-mail and installation identifiers are HMAC-SHA256 pseudonyms using a separate high-entropy server secret.
• License claims are canonicalized and signed with Ed25519.
• The macOS app embeds only the 32-byte public key.
• Local license and activation material use Keychain with AfterFirstUnlockThisDeviceOnly accessibility.
• Production releases fail configuration validation if the license endpoint or public key remains a placeholder.
• Administrative license/organization mutations require a high-entropy bearer token, are rate-limited, and create audit events.
• Browser completion pages receive a nonce-scoped Content Security Policy and no-referrer/no-store headers.

A perpetual offline license cannot be remotely revoked while the app remains offline. Refund/dispute status is observed on the next successful refresh. This is an explicit commercial tradeoff, not a subscription mechanism.

• local/private addresses only;
• temporary pairing window and code;
• ephemeral Curve25519 ECDH;
• HKDF-SHA256;
• directional AES-256-GCM keys bound to sender and receiver IDs;
• bounded frames and timeouts;
• authenticated request/correlation IDs;
• clock-skew checks;
• replay protection;
• Keychain-backed peer material;
• per-peer permission profiles and optional expiration;
• rate limits and concurrent-connection limits;
• PID/start-time verification;
• explicit operation enums rather than shell text.

• Process actions verify the current PID and observed start time immediately before signalling.
• PID 0, PID 1, MacPulse itself, and conservative critical macOS services are denied.
• Administrator authorization is explicit and is used only after a direct operation is refused.
• MacPulse does not bypass SIP, TCC, code-signing policy, or protected system paths.
• Process-tree termination enumerates current descendants and revalidates the root process.
• Priority changes use supported scheduler interfaces and do not claim real-time guarantees.
• Administrator relaunch is disabled by default and limited to non-Apple command-line/background executables.
• No arbitrary remote shell command is introduced by the local elevation feature.

The Apple/default filter uses executable location, application metadata, Security.framework signing information, Apple requirement evaluation, Team ID, and signing identifier. Ambiguous processes remain visible. Classification is a presentation and audit aid; it is not used as the sole authorization boundary for destructive actions.

• no scheduler or periodic capture;
• no hidden capture mode;
• endpoint policy, acknowledgment, Screen Recording permission, paired ACL, valid administrator license, policy version, schedule, reason, and actor are all required;
• local approval can be required for every image and is enabled by default through the endpoint policy;
• mandatory menu-bar state, requester/reason watermark, audible signal, and audit;
• excluded sensitive applications block the entire capture if visible;
• main-display capture only, size bounded;
• encrypted local vault and SHA-256 integrity verification;
• automatic retention deletion.

The default exclusion list is not exhaustive. Organizations must add their password managers, banking tools, medical systems, legal systems, and other sensitive applications.

Do not publish secrets, signing keys, Stripe credentials, screenshots, or employee data in a public issue. Provide:

• affected version and macOS version;
• Intel or Apple Silicon;
• reproduction steps;
• sanitized logs or the built-in diagnostic archive;
• expected and observed result.

Rotate any exposed Stripe, PostgreSQL, admin API, HMAC, or signing credential immediately. An exposed Ed25519 signing key requires a new key ID, a client update containing the new public key, and revocation of the compromised issuer.