229
app sandbox
also entitlements, App Sandbox
The OS allowlist for a desktop app. Entitlements are the permission, not a comment.
What is app sandbox?
An app sandbox limits files, network, camera, and other OS resources to what the entitlements name. macOS App Store apps must be sandboxed. A temporary-exception entitlement is a hole you have to justify. User-selected files are allowed one at a time, not as a home-directory grant.
Why does app sandbox matter when vibe coding?
Generated Mac apps turn the sandbox off, or add com.apple.security.files.user-selected.read-write plus a home-directory exception “so saving works.” Review rejects it, or the unsandboxed build reads the whole disk.
How do you do app sandbox?
Start sandboxed. Add the smallest entitlement that the feature needs. Use the open dialog and bookmarks for documents. Do not grant the home directory.
How do you ask a model for app sandbox?
Sandbox (app). Allow only (entitlement) for (feature). Use security-scoped bookmarks for user files. Do not disable the sandbox. Do not add a home-directory exception.
What goes wrong with app sandbox?
Copying an entitlements file from a gist that includes debugging exceptions, then shipping it.