Security Overview

01The design does most of the work

The most effective protection for your data is not holding it. Existing desktop builds keep projects and provider credentials locally. The website account portal uses a shared account database for authentication, subscriptions, entitlements and session management; desktop and external AI integrations remain pending.

• The account portal supports Google and verified email/password accounts. Passwords are hashed, sessions are server-backed, and changing a password revokes old browser and desktop sessions.
• The portal records registered devices and product access when clients connect. Account linking requires an explicit authenticated action; matching email addresses do not merge accounts.
• No collection of your projects or audio — they never leave your machine through anything we build.
• No provider keys or sign-in tokens held by us, so a compromise of ours cannot expose yours.

A breach of our website could affect account and session records, password hashes, billing references, entitlements, email addresses, support messages and download records. That is not nothing, and we take it seriously. But it is a much smaller surface than a typical software company presents.

02Security in the software

Credentials

• Provider sign-in tokens (OAuth) are held in an encrypted vault on your machine, not in a plain configuration file.
• The configuration file holds only opaque references to vault records, never credential material.
• DAWN’s local API returns a placeholder rather than the credential value, so keys do not reach the interface layer.
• A redaction pass strips key patterns, tokens, and home-directory paths from logs, error messages, and audit records before they are written.

Mac control

• Confirmation gates on destructive, irreversible, and externally visible actions.
• A kill switch that halts native events immediately.
• Refusal to type into a detected password field, or to capture an unredacted screenshot while one is visible. This fails closed — if the check cannot complete, it refuses.
• An audit record of every attempt, with typed text, window contents, and command text redacted.
• Screenshot data is used for a single exchange and never written to disk.

Network posture

• DAWN’s local services bind to the loopback interface only. There is no mode that exposes them to a network.
• The plugin authenticates to the local application with an owner-only key that never enters the interface, the URL, or your project file.
• Outbound requests are validated against a guard designed to prevent requests being redirected to internal addresses.
• Remote endpoints must use HTTPS; plain HTTP is permitted only for loopback.
• Browser automation runs in isolated profiles and refuses to fill fields with values that look like secrets.

Distribution

Releases are code-signed and notarised by Apple. Download only from this website. A build of DAWN from anywhere else is not one we published, and you should treat it as hostile.

03Security on this website

• HTTPS throughout.
• Rate limiting on every public form and download endpoint.
• Input validation and length limits on submitted data.
• Parameterised database queries.
• IP addresses stored as salted hashes rather than in the clear.
• A published retention schedule with deletion implemented in code, so old data does not accumulate indefinitely.
• No third-party scripts, analytics, or trackers — which also means no supply chain risk from them.

04What we do not have

• No certifications. We do not hold ISO 27001, SOC 2, or Cyber Essentials, and we do not claim to be working towards them.
• No third-party penetration test has been carried out on the website or the software.
• No formal security team. We are a very small studio. Security is done carefully, but by the same people who write everything else.
• No bug bounty. We welcome reports and will credit you, but we cannot pay for them.
• No 24/7 monitoring or on-call rotation. We respond as quickly as we reasonably can.
• Unsandboxed execution exists by design. DAWN’s shell and AppleScript lanes run with your user’s permissions. That is what makes the feature work, and it is a deliberate trade-off rather than an oversight — see the DAWN EULA.

If your organisation requires a certified vendor, we are not currently one. We would rather you knew that now.

05What you can do

• Keep macOS and DAWN updated.
• Keep your provider account secure, and set usage limits with your provider where it offers them.
• Revoke access from your provider’s account settings if you think it has been exposed. We cannot do this for you.
• Think about what else is on screen before enabling Mac control.
• Keep backups of work you care about.

06Reporting a problem

If you find a vulnerability, please report it to support@maryalabs.io under our Vulnerability Disclosure Policy. Good-faith research is welcome and we will not pursue you for it.

If a breach affects your personal data, we will notify you and, where required, the ICO within 72 hours of becoming aware of it.