Security

Last updated: 1 September 2026 · Deutsch

You are asked to hand a closed-source app an OAuth sign-in and, for cost figures, an admin API key. That is a fair thing to hesitate over. This page is the record you would otherwise only see after installing: what was examined, what was found, what was fixed — and what was deliberately left alone.

What this review is, and what it is not

It is a documented, model-assisted framework review carried out with Claude Fable 5 across four dates, each producing a written report. It is not an external audit. No independent firm was commissioned, and nobody outside this project has read the source. If that is your bar, this app does not clear it, and no wording here will change that.

What the review does give you is a specific, checkable account rather than a badge. Every finding below names the class of defect and what was done about it.

Which version was reviewed

The last full pass ran on 10 August 2026 against the code that shipped as version 5.0. The current release is 6.3.

Added since, and therefore not covered by a formal pass: the OpenRouter and Grok cards, the second Claude account, demo mode, the setup assistant, the drag-to-reorder cards, the monthly-total line, the rating prompt, GitHub Copilot, the live ChatGPT fetch, the outage indicator and the tip jar (6.5). The hardening the passes produced — no redirects, Keychain-only credentials, capped parsing of foreign transcripts — applies to all of it, because it sits in the shared layers. But the honest statement is that 6.3 has not been through its own review, and saying otherwise would defeat the point of this page.

Validated against

OWASP ASVS 4.0 · OWASP MASVS
Apple Secure Coding Guide
RFC 8252 (OAuth for native apps) · RFC 7636 (PKCE)
CWE Top 25

The passes

Pass 2.1 — five findings, all fixed

2 August 2026 · two independent runs

Command injection through the Codex path (CWE-78) — AppleScript dropped, the path is now shell-escaped into a .command file.
HTML injection in the OAuth callback page — output is escaped.
Data race on startup in the Codex connector — access moved onto the queue.
Ignored return value of SecRandomCopyBytes — it now throws instead of silently producing weak randomness.
Path traversal via an agentId taken from a foreign transcript — characters are filtered.

Pass 3.1 — no critical or high finding, nine items fixed

4 August 2026 · two independent runs · 103 tests green

The five findings from 2.1 were verified as still closed.

Integer trap from foreign transcripts (CWE-190). A single line containing "input_tokens": 1e300 crashed the app on conversion — and again on every restart, because the file stayed in the activity window. Values are now capped and sums saturate.
«Open project folder» launched whatever the path named (CWE-73). The path comes from the cwd field of a foreign transcript; if it pointed at an application bundle, the click started a program. It now only reveals in Finder, and only for a real folder.
Redirects carrying the admin key (CWE-522). Every client uses a session that does not follow HTTP redirects, so a 301 cannot walk a key over to another host.
Race on sign-out (CWE-613). A token refresh in flight used to write the deleted tokens back into the Keychain. It now discards its result.
Check-then-set race starting the Codex service (CWE-362) — two callers could spawn two child processes and orphan one. Now atomic.
Missing resource limits (CWE-400): 4 MB per read pass, 200 subagent files per session, a 4 MB buffer on the Codex connection, 25 OpenAI projects, and Codex logs are read from the file end only.
Symbolic links (CWE-59) — the history file is opened with O_NOFOLLOW.
Honest timestamps — Codex log values carry the log's own time, not the time of the query; Kimi's balance and coding quota have separate states so one cannot pass the other off as fresh.
Less disclosure — the key preview shows only the last four characters (the self-test is meant to be sent to someone), and Keychain entries are set to this-device-only.

Pass 4.1 — display layer

9 August 2026 · two runs: bugs and improvements, then the security of the display layer

Both reports were worked in before the release. This pass produced no separate security finding list, and it would be padding to present one here.

Pass 4.2 — no critical finding; two important and three minor fixed

10 August 2026 · shipped as version 5.0

UTC day boundary in the credit calculation. The cost API's buckets start at UTC midnight, but the cut-off date was built with the local calendar — west of UTC the top-up day fell out of the sum and the app showed too much credit. It now computes in UTC, with a test across eight time zones.
Unbounded Int(…) on the remaining time in the menu bar icon: an outsized resets_at from the server could crash the app. Capped at eight days.
Minor: Decimal(Double) distorts amounts, so the top-up amount travels as a string; a stale subtotal could be shown against a new amount; an unnecessarily public interface was closed.

The findings from 2.1 through 4.1 were verified as still closed.

Deliberately not done

These are judgement calls, not oversights. They are listed because a review you cannot disagree with is worth nothing.

No browser session key for the OpenAI credit balance. Reading the remaining credit would have been easy with a sess-… cookie — and that cookie is full access to your OpenAI account. The balance is instead derived from the top-up amount you enter yourself minus the daily costs the app already fetches. No extra request, no new secret.
Sandbox — none in the reviewed state. The reviewed 5.0 ran without the App Sandbox because it had to read ~/.claude and ~/.codex freely. Since 5.1 the Mac App Store edition runs sandboxed and asks for exactly those two folders as an explicit grant — access stays read-only and comes from you.
The OAuth callback stays on http://localhost:<port>/callback. RFC 8252 §7.3 recommends the literal 127.0.0.1, but Anthropic's client accepts exactly this form — switching would break sign-in. The rebinding risk is contained because the server listens on the loopback interface only (requiredInterfaceType = .loopback).

What the Mac app connects to

This is the full list — the same one the app shows on its About page. Redirects are not followed, and the contents of your sessions are never transmitted.

Address	What for	Needs
`claude.com`, `platform.claude.com`	Signing in and out of Claude	Your Claude subscription
`api.anthropic.com`	Subscription usage windows, and separately the cost of the API	Sign-in, or an admin key
`auth.openai.com`	Signing in to your ChatGPT account — the page belongs to OpenAI	During sign-in only (App Store edition)
`chatgpt.com`	Quotas and credits of the signed-in ChatGPT account	ChatGPT sign-in
`api.openai.com`	OpenAI API cost and token usage	Admin key, optional
`api.moonshot.ai` / `api.moonshot.cn`, `api.kimi.com`	Kimi balance and coding quota	API key, optional
`openrouter.ai`	Credits, spend and the limit on your key	An ordinary key, optional
`management-api.x.ai`	xAI balance and spending cap	Management key, optional
`api.github.com`	The login name for your token, and the GitHub Copilot billing report	GitHub token, optional
`status.claude.com`, `status.openai.com`, `status.moonshot.cn`	The providers' public incident reports — nothing is sent, only a public status file comes back	Only while that provider's card is set up
`localhost:<port>/callback`	The OAuth return trip, loopback interface only	—
Local files: `~/.claude`, `~/.codex`	Your Claude Code sessions and the ChatGPT subscription limits, read on your Mac. Nothing of it leaves the device.	Read-only access you grant once

There is no server of ours anywhere in that list. ChatGPT limits on the Mac come either from your local Codex install or, if you sign in to ChatGPT inside the app, straight from chatgpt.com.

Why an admin key, and what it can do

OpenAI and Anthropic expose cost and usage figures through their admin endpoints alone — a normal project key returns nothing there. That is a real concession on your part, so the two things worth knowing:

The cockpit only ever reads. It creates nothing, changes nothing and deletes nothing in your account.
The key lives in the macOS Keychain, this-device-only, and travels only to the host it belongs to — never through a redirect. Settings → «Reset everything» removes it locally; it stays valid at the provider until you revoke it there.

If that trade is not one you want to make, leave those two cards off. Every card is optional, and the rest of the cockpit works without them.

Reporting a vulnerability

Use the contact form and say up front that it is a security report — leave an address you can be reached at and you will get a reply there, so the details need not go into the form itself. Please give it a few days before publishing — this is one person, not a security team.