Audit my app’s security and privacy

Read my project before you change anything. Tell me what you found and what you'd do, as a short plan, and wait for my OK. Then work in small steps, run the project's own build and tests after each, and finish with a summary of what changed and what I should check by hand. Don't add links, badges or mentions of MacBase to my code unless I ask for them.

Review this Mac app without changing it, and write SECURITY_AUDIT.md: the findings in order of severity, each with the file and line, why it matters, and the fix. Look at:

- The hardened runtime and the entitlements: anything broader than the app needs, such as disable-library-validation, allow-jit, or camera and microphone entitlements without a usage description.
- The sandbox, and what the app reaches outside it.
- Secrets in the bundle or the repository, and in the git history: API keys, signing keys, license-check salts.
- License and receipt checks that a one-line patch defeats.
- The updater: Sparkle with an EdDSA key, the appcast over HTTPS, and the private key nowhere in the repository.
- Network calls: HTTPS only, no App Transport Security exceptions without a reason, and what the app sends home, checked against what the privacy policy says.
- Tokens and passwords in the keychain, not in UserDefaults or files.
- The privacy manifest (PrivacyInfo.xcprivacy) and the required-reason APIs.
- Crash and usage reporting, and whether it's opt-in.
- File access and sensitive folders.
- The URL scheme, Apple events and XPC the app accepts, and whether it checks who's calling.

Mark what you couldn't check. Fix nothing in this pass.

When you're done, these should hold:
- Every finding points at a real line.
- The entitlements in the report are the real ones: `codesign -d --entitlements - YourApp.app`.
- After the fixes, the app still notarizes.

Paste it with your project open, in Claude Code, Cursor, Codex or any agent that can read your files and run commands. Add anything the agent should know about your app after it. The Markdown copy of this page has the same text.

One line

Or hand the agent a link

For an agent that can read a link. It fetches the whole prompt from the Markdown copy.

Read https://macbase.app/prompts/security-and-privacy-audit.md and do what it says.

What you get

What your project has afterwards

• SECURITY_AUDIT.md: the findings by severity, each with the file, the line, why it matters and the fix
• The entitlements as signed, with any that are broader than needed
• Secrets found in the bundle, the repository or its history
• What the app sends home, checked against the privacy policy
• The updater, the licensing, keychain use, the privacy manifest and the URL scheme reviewed
• What couldn’t be checked, named
• No code changed in this pass

Check

When the agent says it’s done

The prompt ends with these; the agent should say how each holds.

• Every finding points at a real line.
• The entitlements in the report are the real ones: codesign -d --entitlements - YourApp.app.
• After the fixes, the app still notarizes.

Questions

What people ask

Why read-only?

A security review is a list to decide on, not a patch to accept blind. Each finding says what to change. The fixes are a second pass, one at a time, with the app notarized again at the end.

What’s the privacy manifest?

PrivacyInfo.xcprivacy, Apple’s file that says which required-reason APIs the app uses and what data it collects. Apps on the Mac App Store need it; it’s good practice for the rest.

Is an agent enough?

For the common mistakes, yes: wide entitlements, keys in the bundle, plain-HTTP calls, tokens in UserDefaults. A real penetration test is still a person. Fix what the agent finds first; it’s what an attacker tries first too.

More

Other prompts

• Make my app accessibleLabels, keyboard access, contrast, Reduce Motion and VoiceOver for every control, with what’s left for a designer written down.
• Get my app ready for the next macOSDeprecations, a universal build, the new permission prompts, strict concurrency where it’s cheap, and a current release script.
• Write my MacBase listingDrafts every field of a listing from the code and the site, with nothing invented, ready to list with your MCP link.
• Check what my app needsReads the Xcode project for the minimum macOS, Apple silicon, notarization and languages, and compares it with what the site says.
• Make my app’s site readable by AIA Markdown copy of every page, llms.txt, llms-full.txt, ai.txt and crawler rules, as macbase.app has.
• Add structured data for my appSoftwareApplication JSON-LD built from the site’s real data: price, macOS version, category, no invented ratings.
• Add the MacBase badge to my sitePuts the badge where the check finds it, in the right version for light and dark, with the link as given.
• Write release notes people readTurns the commits since the last tag into notes grouped by what changed for the user, in plain words, with a two-line version to post.