Skip to content

Security: gigaptera/fabar

Security

SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in Fabar, please do not open a public GitHub issue. Instead:

  1. Email: contact@gigaptera.com

  2. Include:

    • Vulnerability description
    • Steps to reproduce
    • Potential impact
    • Suggested fix (if any)

  3. Allow 7–14 days for a response and patch before public disclosure

Security Considerations

Audio Recording Permission

Fabar requires the "Audio Recording" permission (macOS TCC) to use Core Audio Process Tap. This is:

  • ✅ Legitimate: Required by Core Audio's process-tap API (public API since macOS 14.2)
  • ✅ Isolated: Fabar only reads audio data, does not transmit or store it
  • ✅ Transparent: Permission request is explicit (System Settings → Privacy & Security)

Users grant this permission themselves; Fabar cannot request it silently.

Code Signing & Notarization

Prebuilt Releases:

  • Code-signed with Developer ID Application
  • Notarized by Apple (verified via xcrun stapler validate)

Self-Built Binaries:

  • Sign with your own Developer ID or ad-hoc signing
  • macOS may require security exemptions; follow Apple's guidelines

Data & Privacy

No Network Access:

  • Fabar never connects to the internet
  • No telemetry, no analytics, no tracking
  • Audio is not recorded, stored, or transmitted

Settings Storage:

  • Per-app volume preferences stored in ~/Library/Preferences/app.gigaptera.macsoundmixer.plist
  • Settings are plaintext (currently not encrypted)
  • User has full read/write access to this file

Logs:

  • Diagnostic logs written to ~/Library/Logs/Fabar/Fabar.log
  • Logs may contain app names and sample rates
  • The log file is cleared when it exceeds 2 MB
  • Exported logs are user-controlled

Process Tap Safety

How Process Tap Works:

  1. Fabar requests a tap on a specific app's audio process
  2. Core Audio intercepts that app's output
  3. Fabar reads the audio data (in-memory only)
  4. Fabar re-renders at adjusted gain to the output device

Implications:

  • ✅ Fabar can read audio from any app (requires audio-recording permission)
  • ⚠️ Fabar has visibility into that audio stream (not other processes)
  • ✅ Fabar does not capture audio to disk (unless user explicitly exports logs)
  • ✅ Fabar cannot modify audio from apps it hasn't tapped

Hardened Runtime

Fabar is built with:

  • ✅ Hardened Runtime enabled (ENABLE_HARDENED_RUNTIME = YES)
  • ✅ Code signing with Developer ID
  • ✅ Minimal entitlements (only com.apple.security.device.audio-input)

Known Risks & Mitigations

Risk Mitigation
Memory corruption in render callback Callback uses unsafe pointers intentionally (required for realtime safety: no locks, no allocation); it only touches preallocated ring-buffer memory
Buffer overflows in ring buffer Power-of-two capacity with index masking; reads/writes cannot leave the buffer
Stale reads in gain ramping Acknowledged in code comment; impact is inaudible
Process Tap permissions denial Handled gracefully; UI shows permission hint
Orphaned taps on crash Cleaned up on next launch via destroyOrphanedAggregateDevices()

Dependency & Supply Chain

Fabar has zero runtime dependencies beyond Apple frameworks:

  • No third-party libraries
  • No package managers (no Carthage, SPM)
  • Built entirely with Swift + AppKit + Core Audio

This minimizes supply chain risk.

Supported Versions

Version Status Support Ends
1.0+ Current Ongoing
0.x Archive Historical only

Security updates are released as minor/patch versions when applicable.

Responsible Disclosure Timeline

Example (hypothetical):

  1. 2026-06-15: Vulnerability reported via email
  2. 2026-06-16: Acknowledgment sent
  3. 2026-06-22: Patch developed and tested
  4. 2026-06-23: Version 1.0.1 released (includes fix)
  5. 2026-06-24: Security advisory published (post-patch)

Questions? Contact via GitHub Discussions or email.

There aren't any published security advisories