Helios security model
Helios separates telemetry, fan control and server-side diagnostics so that compromise of one component does not unnecessarily grant broader privileges.
The privileged helper is fan-only
The privileged helper is limited to operations required for fan control. It is not intended as a general administrator-command execution path and its privileges are not extended to unrelated parts of the application.
Battery subsystem is telemetry-only
Battery information is diagnostic and read-only. The battery subsystem is not intended to use the privileged helper for write operations.
Telemetry support is not write authorization
Being able to read telemetry from a Mac does not automatically authorize fan control on that hardware. Write operations have a separate safety gate and unvalidated hardware remains read-only.
XPC and trust boundary
Communication between the app and privileged helper uses an authenticated XPC path with signing and trust checks. Those checks are not intentionally weakened for compatibility.
Least-privilege backend
The public diagnostics endpoint uses a dedicated database account that can insert only the permitted diagnostic columns. It does not have general SELECT, UPDATE or DELETE access to reports.
Separate retention role
Expired-report cleanup uses a separate account without general DELETE permission. It can only execute a constrained database cleanup function for reports at the end of their retention window.
The server is not a remote-control channel
The diagnostics API does not return configuration or executable commands to Helios. A successful response only confirms that a report was stored.
Report a security issue
Security issues or suspicious behavior can be reported to helios@snejda.cz.