Skip to content

Security: biyachuev/LayoutLight

Security

SECURITY.md

Security

LayoutLight is a local macOS menu-bar utility. It does not use networking, analytics, or remote update code. Settings are stored locally in UserDefaults.

Accessibility

Caret and window indicators use macOS Accessibility APIs to read UI geometry from the focused application. LayoutLight uses this access to locate the caret or focused window; it does not store, transmit, or intentionally log user text.

LayoutLight is not sandboxed because Accessibility APIs require running outside the App Sandbox.

Binary Distribution Checklist

This project is published as source code and does not provide official binaries. If you choose to distribute a binary build, verify it before sharing:

  • Build with Hardened Runtime enabled.
  • Sign with a Developer ID certificate.
  • Notarize the app.
  • Verify get-task-allow is absent from release entitlements.
  • Verify the expected entitlements:
codesign --display --entitlements - LayoutLight.app
codesign -dvv LayoutLight.app

In codesign -dvv, confirm the runtime flag is present:

flags=0x10000(runtime)

There aren't any published security advisories