11 — Security & Privacy

From the Burrow™ specification set.

11 — Security & Privacy

Local-First Requirement

Burrow™ processes personal filesystem metadata. Default behavior must keep inventory and file contents on the Mac.

No Telemetry by Default

Do not add:

  • analytics SDKs;
  • crash-report uploads;
  • behavioral telemetry;
  • remote logging;
  • cloud-hosted databases.

Any future telemetry requires explicit product-owner approval and opt-in design.

File Content

File content may be read locally only when necessary for hashing, verification, or explicitly requested functionality.

Do not index or store full document contents in the catalog for v1.

Secrets

If the UI communicates with a localhost engine, protect it with a random local secret and bind only to loopback.

Never place secrets in source control.

API Surface

Do not expose:

  • arbitrary shell execution;
  • arbitrary SQL execution;
  • arbitrary unrestricted filesystem mutation;
  • remote network binding by default.

Use domain-specific endpoints.

Database

Protect the catalog with normal user filesystem permissions. Evaluate optional database encryption later if metadata sensitivity warrants it.

Logs

Logs must avoid unnecessarily capturing:

  • file contents;
  • credentials/tokens;
  • excessive personally sensitive metadata.

Paths are necessary operational data but should remain local.

Permissions

Request the minimum macOS permissions needed.

The application must function gracefully when a root is not authorized.

Cloud APIs

Initial versions should not require Microsoft Graph or other provider credentials. If provider APIs are introduced later, use least-privilege scopes and store credentials in macOS Keychain.

Supply Chain

Pin dependencies appropriately, use lockfiles, and avoid unnecessary native binaries or cleanup libraries with broad filesystem privileges.