Security
Releases
Oci desktop app 1.0.0
- Updates are signed, and the app verifies the signature before installing.
- The security assessments for your installed release are shown in the Security tab.
- Important security and stability updates are clearly identified. Required updates explain why you need to update before continuing.
What we assess in every release
These are the assessments in our release process. The Oci desktop app shows the results for your installed release in its Security tab, once the signed evidence for that release is verified.
Source and runtime assessments
| Assessment | What it checks |
|---|---|
| Secret detection | Gitleaks scans fetched Git history for exposed credentials. |
| Known vulnerabilities | Trivy checks locked Swift dependencies. High and critical findings block a release. |
| Swift security rules | Semgrep checks seven focused rules covering TLS, Keychain, weak digests, shell and WebView usage. |
| App configuration | Checks transport-security exceptions and risky entitlements. |
| Memory and boundary tests | Address and Undefined Behavior Sanitizers run the Mac tests, including vault tampering, OAuth and signed policies. Includes a Release build and Clang analysis. |
| Concurrency tests | Thread Sanitizer checks the Mac test suite for data races. |
| Extended Swift analysis | CodeQL security-extended queries, when enabled for the assessment. |
Signed release checks
| Assessment | What it checks |
|---|---|
| App signature | Verifies the app and nested code signatures. |
| Signing identity | Matches the configured Apple developer team. |
| Developer ID | Requires a Developer ID Application signature. |
| Hardened runtime | Confirms Apple's hardened runtime is enabled. |
| Entitlement inspection | Confirms signed app entitlements can be inspected. |
| Restricted entitlements | Rejects debugging and selected unsafe runtime permissions. |
| Apple notarization | Validates the notarization ticket attached to the app. |
| Gatekeeper | Confirms Gatekeeper accepts the exported app on the assessment machine. |
Coverage and limits
Security results describe the checks we performed and their limits. They are release-time evidence, not continuous monitoring, a guarantee of security, or an independent security certification.