Scope and trust assumptions
Protected assets include device authorization, the exact device identifier, coordinates and history, local paths, process privileges, and the integrity of the native/Python boundary. PinShift never asks for an Apple ID, account token, or another person's location.
The host operating system, signed application bundle, and user account must remain trusted. A local attacker able to replace the installed app or sidecar is outside this model.
Webview and native boundary
The Tauri webview can call only named operations for environment checks, setup repair, authorized-device preparation, start/clear simulation, cancellation, bounded timeouts, demo scenarios in demo builds, and the explicit quit-without-restore choice.
Process and argument safety
- Rust starts one fixed packaged sidecar path.
- Device IDs and coordinates are validated as typed values across Rust and Python boundaries.
- Arguments are passed as an array and never interpolated into a shell command.
- Output is bounded, request IDs must match, and malformed or oversized protocol messages invalidate the worker.
- Only processes owned by PinShift are supervised or stopped.
- A single operation lock prevents incompatible device operations from overlapping.
Recovery and restore
Before sending a set-location request, the native layer writes a private marker that contains only restore-required. It stores no device ID, coordinate, label, or personal path. A confirmed clear removes the marker.
If the app exits unexpectedly, the next launch retains a potentially-active state and offers restore. A failed or unconfirmed clear never becomes a success claim.
Identifiers, storage, and logs
Full device identifiers are not sent to the frontend or stored in favorites, history, or normal logs. Technical output is capped and redacts home/profile paths, UDID-shaped values, coordinate-shaped values, usernames, and temporary paths before IPC.
Release security
A public Mac build must use one Developer ID identity consistently across nested Python components and Tauri, enable hardened runtime, complete Apple notarization, staple the ticket, pass Gatekeeper, and publish an exact SHA-256. The public website refuses to enable a download without those metadata gates.
Network and update boundaries
PinShift has no automatic self-updater in the current release line. A future updater must verify an explicit release origin, signed manifest, package signature, and digest. The pinned device tooling can request a missing Developer Disk Image from its fixed source over TLS; download completion is not treated as a successful mount.
Report a security issue
Do not include full device identifiers, exact private coordinates, pairing records, Apple credentials, or personal paths. Provide the PinShift version, macOS and iOS versions, redacted activity text, and reproducible steps.
The project does not yet publish a dedicated security inbox. Repository collaborators can use the private reporting path described in the source repository; public reporting details will be added before a public binary release.