Run it in a VM
Everything in the guest runs at ring 0 in one address space. A bad pointer can take the whole guest down. The VM is the boundary.
Security
What is protected, and what is not.
TempleOS has no memory protection. So the desktop puts its protection where it can: on the host, in the installer, and in the permissions every app asks for. This page says plainly which is which.
Source: the installer, Electron and hub notes in the repository. The guest side is not audited. What leaves your machine is on the Privacy page.
The short version
The host owns trust
The store, the trust list and every grant live on the host, never in the guest. The guest only shows the questions.
Default deny
An app gets nothing it did not ask for and you did not approve. More permissions in an update are asked again.
Four layers, four different promises.
HolyC apps
Run inside the desktop with no memory protection. Their permissions gate host services only; they cannot stop a hostile app from reading guest memory.
Web apps
Bound by the browser sandbox, and calls to the desktop are checked against grants.
Electron apps
Run on the host with limits we apply: a fixed profile folder, a minimal environment and one workspace folder. These are limits, not a wall.
The host hub
Owns the registry, the trust list and approvals. This is where the real checks happen.
Installing an app.
Packages are .ksapp files signed with Ed25519. Pick a trust state to see what the installer does.
Outcome: Installs
Trusted
The package is signed by a key you already trust. It installs, and a trusted publisher skips the first-launch prompt.
Outcome: Asks first
New publisher
Signed, but the key is new to this Mac. The Install sheet shows the publisher and key fingerprint and asks whether to trust them for future installs and updates.
Outcome: Warns, quarantines
Unsigned
Nobody vouches for who made it. The sheet says so in words and the button reads Install anyway. The app is quarantined until you open it once.
Outcome: Never installs
Bad signature
The files do not match what was signed, or the signature is wrong. This is the red case.
Outcome: Never installs
Revoked
The publisher key was withdrawn. Installs and updates are refused, and rollback re-checks the revocation list.
What an app can ask for.
Permissions are words with one plain sentence each. Click one.
Keep its own data
A private folder for the app. Nothing else on the Mac.
Granted on the host. Revoke any time.
Read one workspace folder
Read files in the one folder you chose, and nothing outside it.
Granted on the host. Revoke any time.
Change one workspace folder
Read and write files in the one folder you chose.
Granted on the host. Revoke any time.
Use the network
Reach the internet. Without this, the browser engine blocks network requests.
Granted on the host. Revoke any time.
Save downloads
Put downloaded files in the app's own downloads folder.
Granted on the host. Revoke any time.
Use the clipboard
Read and write the clipboard.
Granted on the host. Revoke any time.
Show notifications
Post notifications to the desktop.
Granted on the host. Revoke any time.
Talk to an agent
Let the app drive an AI agent, which is itself bound by the default-deny rules.
Granted on the host. Revoke any time.
One named site
Reach one named host, not the whole internet.
Granted on the host. Revoke any time.
One hub service
Call one named service on the host, such as weather or music.
Granted on the host. Revoke any time.
The plain-language sentences here are paraphrased for this page; the installer shows its own.
In the installer
All tested offline: 92 tests pass.
Atomic installs
Files are verified while they are written, then moved into place in one step. A crash leaves nothing half installed.
Nothing is executed
The installer never runs anything from a package. It only unpacks and checks.
Hostile archives
Symlinks, device files, duplicate names and case or Unicode lookalikes are refused, as are bad paths and over-size packages.
Updates stay in the family
An update needs the same id, a higher version and the same signing key. A different key is refused. Going back is a separate rollback that re-checks everything.
Quarantine
Unsigned, new-publisher and downloaded installs are quarantined until first opened. Updates from the same key inherit the cleared state.
Approval tokens
When a service needs a decision, the hub asks the guest to show a sheet and repeats the call with a one-use token tied to the app, version, package hash, key and permission set.
Electron apps on the host
They run as real processes on your Mac, so this is where the limits matter.
A real folder only
The workspace must be an actual directory, not a link, and never the filesystem root, your home folder, .ssh, Library or similar protected places.
A minimal environment
No HOME, no tokens, no SSH agent socket. Profile, extensions and downloads live in fixed folders for the app.
Network off unless granted
Without host:net, the browser engine blocks network requests.
A kill switch
One command stops an app and closes its browser.
AI agents
Default deny, with the question shown in the desktop.
Reads are free in the workspace
An agent can read inside the workspace folder without asking.
Everything else waits for you
Writes, shell commands, network access, git push and secret reads wait for a key press in the guest.
Nothing outside the workspace
Writes outside the workspace are refused outright.
Said out loud.
What is not promised
- Protection from a malicious HolyC app. There is no memory protection in the guest, and the installer says so on its sheet.
- That a trusted publisher is honest. Trust means a known key, not good intentions.
- Malware scanning. Packages are checked for integrity and signature, not scanned.
- A wall around Electron. An unsandboxed app can read anything the user can; this was tested. A profile that confines the node runtime exists, but the full Chromium app will not start under it.
- Safety if the Mac account is already compromised.
- Replay safety against a hostile guest. A hostile guest can replay a token during its window, which is a known limit of the hub design.
- Key succession. A stolen publisher key is handled by revocation and re-trust, not by an automatic hand-over.
Coming next.
Part of the HC+ plan. None of this is built yet.
Catchable faults
A page fault in an app becomes an exception the desktop catches, so one bad pointer drops a frame rather than opening the debugger.
Debug allocator
Canaries around allocations and checked array indexes in debug builds.
Crash policy
Autosave Notes, count faults, and skip an app that faulted twice. Snapshot restore stays the backstop.
Reporting a problem
Placeholder: add a security contact and a disclosure policy before this site is published.
Details: the installer note (threat table, trust states), Electron apps and the HolyC analysis (the safety section).