Security audit: pin MASShortcut, confirm URL tasks, harden config auto-load

[JakubAnderwald]

This PR is the result of a source-level security audit of Rectangle. The full report is included as SECURITY_AUDIT.md at the repo root and explains the methodology, every finding (with severity), what was changed, and what was deliberately left for follow-up.

TL;DR — outbound data

The audit confirms what the README implies: Rectangle contains no telemetry, no analytics, and no crash reporting. The only outbound network channel is the EdDSA-signed Sparkle update feed at https://rectangleapp.com/downloads/updates.xml (system profiling is off by default — SUSendProfileInfo/SUEnableSystemProfiling are not set).

Fixes in this PR

1. [High] Supply chain — pin MASShortcut. Rectangle.xcodeproj/project.pbxproj had MASShortcut pinned to branch = master, so every build silently pulled the latest tip with no review gate. Pinned to the current HEAD commit (2f9fbb3f959b7a683c6faaf9638d22afad37a235) via kind = revision. Recommend follow-up: tag MASShortcut releases upstream and switch to upToNextMajorVersion, matching how Sparkle is configured.

2. [Medium] URL handler — confirm execute-task actions. rectangle://execute-task?name=ignore-app&app-bundle-id=... (and unignore-app) previously mutated the disabled-apps defaults silently from any URL source, including a web page. Added an NSAlert confirmation showing the requested action and bundle-id. The confirmation is skipped only when Rectangle itself is frontmost, so the in-app/Stream-Deck/Shortcuts.app workflows are unchanged. execute-action is intentionally left alone — those actions are reversible and silent execution is the documented contract.

3. [Medium] Config.loadFromSupportDir() — confirm + harden. On every launch Rectangle auto-loaded any ~/Library/Application Support/Rectangle/RectangleConfig.json and applied it (overwriting shortcuts and the entire defaults set), so any process running as the user could rewrite Rectangle config silently. Now:

   • Asks the user to Apply / Discard before importing.
   • Refuses symlinks and world-writable files (and warns the user).
   • Adds a 1 MiB size cap inside load(fileUrl:) so both auto-load and the explicit Import button are protected from OOM via a giant config file.

Not changed in this PR (low severity, documented in SECURITY_AUDIT.md)

• Optional scheme/bundle-id shape validation in the URL handler.
• codesign --force --deep in .github/workflows/build.yml (Apple-deprecated; tangentially runs-on: macos-26 is also not a valid runner label).
• Adding a SECURITY.md with a disclosure address.

Verification

• plutil -lint reports the modified project.pbxproj is valid; brace count is balanced.
• No xcodebuild archive build was attempted from the audit machine (no Xcode + no signing identity). Maintainer CI will exercise the full build on this PR.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[rxhanson]

Thanks! I appreciate the audit. I tested out the additional checks and they looked good.