Security

Status: draft. The helper has been built and reviewed against the threat model below, with tests. A check on a signed release build (the approval flow, the real code-signing requirement, fan control on each Mac model) is still to be done, so treat what follows as design and review, not as proof.

Hedroom can pause apps, move files to the Trash and, with your approval, set fan speeds. That is a lot of trust, so here is how it is limited.

How it is delivered

Signed and notarized. Hedroom is signed with a Developer ID, built with the Hardened Runtime, and notarized by Apple.
Signed updates. Updates come through Sparkle over HTTPS and must carry Hedroom's own signature (EdDSA) as well as Apple's notarization.
A signed process library. The list that explains processes is signed (Ed25519). Hedroom checks the signature and version before using a new copy and keeps the old one if the check fails.
Not sandboxed, not on the Mac App Store. The sandbox does not allow pausing or relaunching other apps or reading their memory, which is the point of Hedroom. That is why the limits below matter.

The helper, in plain words

Almost everything in Hedroom runs as you. Two things need more: setting fan speeds on a MacBook Pro, and raising the GPU memory limit. For those there is a small helper that runs with admin rights. It requires approval in System Settings › General › Login Items, Hedroom asks only when you turn on one of those features, and it is removed when you uninstall Hedroom. It lives inside the Hedroom app, and nothing is installed into /Library.

What a malicious program could try

Talk to the helper directly. macOS only lets a program connect if it is signed with Hedroom's Developer ID, for Hedroom's team and app identifier. The helper checks the same thing again on each connection. A re-signed or modified copy of Hedroom is refused.
Send it crafted messages. There is one entry point, which takes a small block of data (16 KiB at most) and decodes it strictly. Anything unexpected is refused before any hardware is touched. It has been fuzz tested.
Ask for something unusual. The helper understands exactly ten operations: read its version, answer a ping, read process memory and CPU as numbers, read fans, set one fan's target, return one or all fans to automatic, read the GPU memory limit, set it, and reset it. There is no eleventh.
Ask for a value that hurts. The helper reads each fan's own minimum and maximum, and the Mac's memory size, itself, and checks every request against them. It never trusts limits sent by the app. A GPU limit that would leave macOS under 8 GB is refused.
Use a different login. On a Mac with more than one user, only the person at the screen can use the helper, and a second connection cannot take over while another one holds the fans.
Hammer it. Each connection is rate limited.

What the helper can never do

Run a program or a shell. Open, read or write a file. Take a file path. Use the network.
Write any hardware setting except fan speed, or any system setting except the GPU memory limit.
Reveal process names, paths or arguments. It returns numbers only.

If something goes wrong

When Hedroom quits, crashes or loses the helper, the fans go back to automatic and a raised GPU limit goes back. If Hedroom simply stops answering, the helper does this itself after 10 seconds.
It puts the GPU limit back to what it was before Hedroom raised it, and only if the limit still holds the value Hedroom set. If you changed it yourself in the meantime, Hedroom leaves your value alone.
Hedroom does not fight macOS. If macOS reports a serious thermal state, the fans are handed back.

What this does not cover

Someone who already has admin rights on your Mac, or who can sign code with Hedroom's Developer ID certificate, does not need the helper. Protecting that certificate is on us.

The browser companion

The extension talks to the Mac app through a small program inside Hedroom that the browser starts. Each end checks the other before reading a byte: the app confirms the program is Hedroom's, signed by the same team, and started by a supported browser signed by its own vendor; the program confirms the app. The connection lives in a private folder only you can open. A message has fields for counts, minutes and fixed words and has no field for a URL, a title or a tab, and anything else is rejected. One limit remains: a program already running as you could load a copy of the extension. All it could do is send counts and read the whole browser's memory total. No URL or title can cross.

Files

Cleanups go to the Trash and only from places Hedroom has a list for. Each path is resolved and checked again just before it moves, and files open in an app are skipped. Startup items are renamed, never deleted.

Report a problem

Email security@hedroom.app. Our security.txt has the details. We acknowledge a report within 72 hours.

It helps to include the Hedroom version, your macOS version, and the steps to reproduce. Please give us a reasonable time to fix a problem before you publish it, and please test only on Macs you own.

Privacy · The helper in the feature list · What Hedroom never does