| Version | Supported |
|---|---|
| 1.1.x source/tag | Supported, public binary release pending signed/notarized artifact |
| 1.0.x public asset | Not trust-complete; use source or a corrected 1.1.x release path |
Vifty uses a privileged XPC helper (LaunchDaemon) to write fan SMC keys as root, and a local viftyctl CLI for agent-controlled cooling leases. We take safety and security seriously.
Please do not open a public issue for security vulnerabilities.
Instead, report vulnerabilities privately via GitHub Security Advisories:
- Go to Security → Advisories → Report a vulnerability on this repository.
- Describe the issue, affected components, and reproduction steps.
- We aim to acknowledge within 48 hours and publish a fix within 90 days.
For the detailed privileged-helper, SMC write, release-signing, and agent-control trust boundaries, see docs/trust-model.md.
For the current public binary trust state, see docs/release-status.md. A source tag, CI artifact, or ad-hoc local build is not a substitute for a Developer ID signed, notarized, stapled release artifact with a verified cask checksum.
Vifty's trust boundaries:
| Boundary | Description |
|---|---|
| App ↔ Daemon (XPC) | The unprivileged SwiftUI app communicates with the root daemon via XPC. The daemon validates client signing identifiers, optionally requires a release TeamID, clamps all fan RPM targets, and the SMC client only permits Vifty's fan-control write keys. |
| Agent CLI ↔ Daemon (XPC) | viftyctl sends bounded workload cooling leases through the daemon. Every lease carries a mandatory duration, reason, and idempotency key; the default policy caps leases at 30 minutes. The daemon enforces expiry independently. |
| Daemon ↔ SMC (IOKit) | Only the root daemon writes SMC keys, and low-level writes are allowlisted to fan mode, fan target, and guarded force-test keys. The app never attempts direct AppleSMC writes (fail-closed). |
| Local filesystem | Curve profiles, manual-control markers, and agent-control lease/audit files are stored locally with restricted permissions. No data leaves the device. |
| Agent lease safety | User Auto-restore always wins over active and in-flight agent cooling. Sensor loss, unsupported hardware, helper uncertainty, or critical thermal pressure refuses or restores control. |
In-scope for security reports:
- Privilege escalation via the XPC interface
- Daemon bypass allowing unprivileged SMC writes
- Agent lease escape (cooling applied without bounded duration or beyond expiry)
- Unsafe RPM targets reaching SMC writes
- Information disclosure from local storage
Out of scope:
- Denial-of-service via excessive local lease requests beyond the built-in prepare cooldown/rate limit
- Physical access attacks
- Issues in dependencies (report upstream)
- Social engineering
We follow coordinated disclosure. Once a fix is released, we will:
- Publish a GitHub Security Advisory with CVE if appropriate.
- Credit the reporter (unless anonymity is requested).
- Document the fix in the release notes.