---
title: "Helios security model"
description: "Helios separates telemetry, fan control and server-side diagnostics so that compromise of one component does not unnecessarily grant broader privileges."
canonical: "https://www.snejda.cz/en/helios/security"
language: "en"
---

# Helios security model

Helios separates telemetry, fan control and server-side diagnostics so that compromise of one component does not unnecessarily grant broader privileges.

## The privileged helper is fan-only

The privileged helper is limited to operations required for fan control. It is not intended as a general administrator-command execution path and its privileges are not extended to unrelated parts of the application.

## Battery subsystem is telemetry-only

Battery information is diagnostic and read-only. The battery subsystem is not intended to use the privileged helper for write operations.

## Telemetry support is not write authorization

Being able to read telemetry from a Mac does not automatically authorize fan control on that hardware. Write operations have a separate safety gate and unvalidated hardware remains read-only.

## XPC and trust boundary

Communication between the app and privileged helper uses an authenticated XPC path with signing and trust checks. Those checks are not intentionally weakened for compatibility.

## Least-privilege backend

The public diagnostics endpoint uses a dedicated database account that can insert only the permitted diagnostic columns. It does not have general SELECT, UPDATE or DELETE access to reports.

## Separate retention role

Expired-report cleanup uses a separate account without general DELETE permission. It can only execute a constrained database cleanup function for reports at the end of their retention window.

## The server is not a remote-control channel

The diagnostics API does not return configuration or executable commands to Helios. A successful response only confirms that a report was stored.

## Report a security issue

Security issues or suspicious behavior can be reported to helios@snejda.cz.

---

HTML version: https://www.snejda.cz/en/helios/security  
Other language: https://www.snejda.cz/helios/security  
Overview for agents: https://www.snejda.cz/llms.txt