Migrated from TODO.md.
KeychainCredentialManager currently scopes items only by the consumer-supplied KeychainAppIdentifier. Two apps sharing the same login keychain and the same identifier can read each other's items. Harden by requiring the running binary to match the item's creator (e.g. SecAccessControl / a trusted-application ACL) so a neighbouring app can't read another CLI's items even with the same app identifier.
Notes / constraints:
- macOS-only P/Invoke against Security.framework; needs a real macOS environment to develop and verify (can't be validated on the Linux dev box or in a headless run).
- The current limitation is documented in
SECURITY.md; update it once this lands.
Acceptance: items created by one binary are not readable by a different binary sharing the same app identifier, verified on macOS CI.
Migrated from
TODO.md.KeychainCredentialManagercurrently scopes items only by the consumer-suppliedKeychainAppIdentifier. Two apps sharing the same login keychain and the same identifier can read each other's items. Harden by requiring the running binary to match the item's creator (e.g.SecAccessControl/ a trusted-application ACL) so a neighbouring app can't read another CLI's items even with the same app identifier.Notes / constraints:
SECURITY.md; update it once this lands.Acceptance: items created by one binary are not readable by a different binary sharing the same app identifier, verified on macOS CI.