RSync-Studio/Docs/AUDIT.md

Rsync Studio — Security / Release Audit

This project targets direct macOS distribution using Developer ID signing and Apple notarisation. App Sandbox is intentionally disabled because the product launches rsync/SSH and operates on arbitrary user-configured filesystem paths.

Security controls present

• Hardened Runtime enabled for Debug and Release target configurations.
• No shell (/bin/sh -c) command construction; Process uses an absolute executable path and argument array.
• SSH host-key checking is not disabled.
• Automated SSH uses BatchMode, timeout and keepalive limits.
• SSH password authentication/storage is not supported; legacy stored password data is deleted.
• Remote host, username, port, key path and remote destination are validated.
• Remote paths reject shell metacharacters before rsync can invoke the remote shell.
• Advanced arguments reject transport replacement, remote-command, credential, arbitrary list/log/batch path and destructive overrides.
• Malformed Advanced argument quoting/trailing escapes are rejected.
• -- terminates rsync option parsing before source/destination operands.
• Local source/destination overlap is rejected.
• File-watch and exclusion values reject control characters.
• Scheduled/watch delete requires explicit per-job authorisation.
• Run logs are ANSI-cleaned, likely credentials redacted and size-capped before persistence.
• Run history has bounded retention.
• Privacy manifest declares no tracking/no collected data and the app-specific UserDefaults required reason.
• Launch at login uses SMAppService and remains user-controlled.
• No analytics/telemetry or application HTTP client code is present.

Required release verification on a Mac

Run:

./Scripts/release-preflight.sh

Then archive with Developer ID, submit with Apple notarytool (or Xcode Organizer), staple the ticket and run the signature/Gatekeeper checks in Docs/RELEASE.md.

A Linux source audit cannot substitute for Xcode's macOS SDK typecheck, code signing, notarisation or Gatekeeper assessment.