# Audit my app’s security and privacy

Canonical page: https://macbase.app/prompts/security-and-privacy-audit

A read-only review of entitlements, the sandbox, secrets, licensing, the updater, network calls and the privacy manifest.

## The prompt

Everything from here to the next heading is the task. Do it for the project you have open.

Read my project before you change anything. Tell me what you found and what you'd do, as a short plan, and wait for my OK. Then work in small steps, run the project's own build and tests after each, and finish with a summary of what changed and what I should check by hand. Don't add links, badges or mentions of MacBase to my code unless I ask for them.

Review this Mac app without changing it, and write SECURITY_AUDIT.md: the findings in order of severity, each with the file and line, why it matters, and the fix. Look at:

- The hardened runtime and the entitlements: anything broader than the app needs, such as disable-library-validation, allow-jit, or camera and microphone entitlements without a usage description.
- The sandbox, and what the app reaches outside it.
- Secrets in the bundle or the repository, and in the git history: API keys, signing keys, license-check salts.
- License and receipt checks that a one-line patch defeats.
- The updater: Sparkle with an EdDSA key, the appcast over HTTPS, and the private key nowhere in the repository.
- Network calls: HTTPS only, no App Transport Security exceptions without a reason, and what the app sends home, checked against what the privacy policy says.
- Tokens and passwords in the keychain, not in UserDefaults or files.
- The privacy manifest (PrivacyInfo.xcprivacy) and the required-reason APIs.
- Crash and usage reporting, and whether it's opt-in.
- File access and sensitive folders.
- The URL scheme, Apple events and XPC the app accepts, and whether it checks who's calling.

Mark what you couldn't check. Fix nothing in this pass.

When you're done, these should hold:
- Every finding points at a real line.
- The entitlements in the report are the real ones: `codesign -d --entitlements - YourApp.app`.
- After the fixes, the app still notarizes.

## What you’ll have

- SECURITY_AUDIT.md: the findings by severity, each with the file, the line, why it matters and the fix
- The entitlements as signed, with any that are broader than needed
- Secrets found in the bundle, the repository or its history
- What the app sends home, checked against the privacy policy
- The updater, the licensing, keychain use, the privacy manifest and the URL scheme reviewed
- What couldn’t be checked, named
- No code changed in this pass

## Questions

**Why read-only?**

A security review is a list to decide on, not a patch to accept blind. Each finding says what to change. The fixes are a second pass, one at a time, with the app notarized again at the end.

**What’s the privacy manifest?**

PrivacyInfo.xcprivacy, Apple’s file that says which required-reason APIs the app uses and what data it collects. Apps on the Mac App Store need it; it’s good practice for the rest.

**Is an agent enough?**

For the common mistakes, yes: wide entitlements, keys in the bundle, plain-HTTP calls, tokens in UserDefaults. A real penetration test is still a person. Fix what the agent finds first; it’s what an attacker tries first too.

## More

- [All prompts](https://macbase.app/prompts)
- [List your app on MacBase](https://macbase.app/submit)