The macOS Security Model and What It Asks of TextPack

What TextPack does on a Mac

TextPack is a macOS 14 utility that keeps one text or Markdown source beside a PDF preview and exports PDF, Markdown or TXT. It runs on Apple silicon and Intel. A feature called Recipient Preflight runs deterministic checks on the source, such as unclosed code fences, inconsistent table columns and leftover placeholders.

Editing, preflight, preview and export all happen on the Mac. Our privacy policy states that document text, clipboard content, file names and exported files are not uploaded for those operations. Conversion history is stored locally, with auto-deletion after 7 days, after 30 days, or never.

The app has no account system. Those facts define its security profile: it reads text the user gives it, writes files the user asks for, and talks to the network for a short list of service tasks.

Distribution outside the Mac App Store

TextPack ships as a disk image downloaded from our own update host, and Free and Pro use the same public download. Lemon Squeezy handles checkout and emails the license key. Updates are checked with Sparkle, an open source update framework for Mac apps.

The distribution channel decides which rules are mandatory. Apple requires the App Sandbox for every app sold in the Mac App Store. For software distributed directly, the sandbox is optional, and the mandatory checks are a Developer ID signature and notarization.

Gatekeeper enforces those checks on first launch of downloaded software. It verifies that the app is signed with a Developer ID certificate and that Apple's notary service has scanned it and issued a ticket. Since macOS 10.15, software without notarization is blocked by default.

The release checklist we keep with the textpack.app site lists a valid Developer ID Application certificate and a notarization step for the disk image among its release requirements.

Hardened Runtime and entitlements

The Hardened Runtime is a set of process restrictions that notarization requires. It blocks code injection, loading of libraries signed by another team, and writable executable memory. It also closes access to the camera, the microphone and similar resources until the app declares them.

Each restriction can be lifted by an entitlement. Entitlements are key and value pairs embedded in the code signature, so they cannot be changed after signing without invalidating it. Anyone can read them from a shipped app with Apple's codesign tool.

For a document tool the design question is whether any exception is needed at all. An app that renders PDF with native macOS APIs, as our privacy policy describes for TextPack, has no need for just-in-time compilation or for third-party plug-ins. Every exception left undeclared is a class of attack the system blocks for free. We do not publish TextPack's entitlement list in this article.

What the App Sandbox adds

The App Sandbox confines a process to its own container directory and to the capabilities its entitlements name. A sandboxed app that is compromised can reach its container and whatever the user has explicitly handed to it. Outbound network connections, user-selected file access and printing each need their own entitlement.

File access in the sandbox runs on user intent. The open and save panels are drawn by a separate system process. When the user picks a file, the system extends the app's sandbox to that one file. Drag and drop works the same way. The app never needs permission to browse the disk.

Access granted that way ends when the app quits. To reopen a file or a folder on the next launch, the app stores a security-scoped bookmark and brackets each use with calls that start and stop access.

A local export tool has to settle these points before it can adopt the sandbox:

• Whether every export goes through a save panel, or whether the app remembers an export folder and therefore needs a bookmark for it.
• Whether locally stored history lives entirely inside the container.
• Whether the updater can replace the app from inside a sandbox. Sparkle documents a separate setup for sandboxed apps.
• Whether the outbound network entitlement covers every request the app makes.

TCC and user consent

Transparency, Consent and Control, usually shortened to TCC, is the system that shows permission prompts and records the answers. It covers the camera, the microphone, screen recording, accessibility control, and since macOS 10.15 the Desktop, Documents and Downloads folders.

TCC applies to sandboxed and unsandboxed apps alike. An unsandboxed app that reads the Documents folder on its own initiative triggers a prompt. The same app opening a file the user chose in an open panel does not, because the selection is the consent.

The consequence for a document tool is a rule we can state simply: touch files only as the direct result of a user action. An app that follows it shows no folder prompts. Each prompt that does appear is a moment where a person has to decide whether to trust the app, and a tool that turns text into a PDF has no reason to ask for the camera or for screen recording.

The network surface

TextPack's network use is limited to five purposes, listed in its public description for language models and in its privacy policy:

1. 1.App download.
2. 2.Purchase.
3. 3.License activation and revalidation.
4. 4.Update checks.
5. 5.Optional diagnostics, only when the user enables them.

The privacy policy states that these service requests do not include document text, clipboard content, file names or exported files. The update check is a standard HTTP request to our update server asking whether a newer version exists.

A short list like this is a security property in its own right. It can be checked from outside with a network monitor, and it means a single outbound-connection capability describes everything the app does online. No server of ours takes part in document processing, so there is no upload path for a document to leak through.

How the layers fit together

Each macOS layer answers a different question. The Developer ID signature says who built the app. Notarization says Apple scanned that exact build. The Hardened Runtime limits what the process can do to itself. The sandbox limits what it can reach. TCC asks the user about the most sensitive resources.

For direct distribution the first three are required and the sandbox is a choice. Our view is that a tool which handles other people's documents should behave as if it were sandboxed whether or not the entitlement is set: files by user selection only, storage in its own directories, and a network list short enough to print.