Security and limits

What protects you today#

• Every add-on in the Store has been reviewed and merged into the public LedgeAddOns repository.
• Store builds come from the merged commit, in a job that pull requests can't touch.
• Ledge checks every downloaded file against the catalogue's hash, and only downloads from LedgeAddOns releases.
• Ledge validates every package, from the Store or your Mac, before installing it.
• Ledge asks you to trust each add-on, and names its author, before anything runs.
• Ledge handles sign-in and keeps credentials in the Keychain. Add-ons use accounts through Ledge and never receive a token.
• Ledge grants only the capabilities it knows and you approved, and asks again when an update wants more.
• Add-ons can't draw on screen. Ledge draws what they describe, after checking it against its limits.
• Each add-on's settings are its own, and stopping it stops everything it started.

What isn't in place yet#

• No sandbox. An add-on runs as a separate process, but with your user account's access. Install only add-ons from developers you trust.
• Development signatures. Store builds are ad-hoc signed, not signed with a Developer ID or notarised. The hash proves a file is the one in the catalogue, not who made it.
• No install counts. An add-on's page shows Installs as “Not available” until a service can count verified installs.
• No automatic updates. The Store shows when a newer version is out; you choose Update.

What's next#

Roughly in this order:

1. ledgekit new, build, install and run, and a preview harness for every surface.
2. Ledge Playground, a separate app for trying add-ons without touching your everyday Ledge.
3. Store builds signed with a Developer ID and notarised.