1. macOS App Sandbox & Entitlements
Hollow is compiled with Apple's Hardened Runtime and strict macOS App Sandbox entitlements (com.apple.security.app-sandbox). The browser is restricted to outgoing network connections (network.client) and user-selected storage.
2. Process Isolation per WKWebView Tab
Every browser tab runs in its own decoupled WebKit rendering process. Web execution occurs in isolated WebContent processes:
- Crash Resilience: If an untrusted script or heavy web page crashes, only that individual tab is terminated without taking down your window or AI chat.
- Memory Safety: Swift's memory safety prevents buffer overflows, use-after-free exploits, and pointer corruptions.
3. Apple Keychain & Secure Enclave
Hollow integrates with macOS Keychain Services (Security.framework). When you store your Groq or Gemini API keys, they are encrypted with AES-256 via Apple's Secure Enclave.
4. Vulnerability Disclosure
If you discover a security issue or potential vulnerability in Hollow's architecture, please report it directly through our GitHub issue tracker or contact security maintainers directly. We commit to reviewing reports within 48 hours.
