Contained by design, from the first launch.
BitShout is a native macOS application with a trusted background service and two system extensions. Opening it does nothing to your machine until you decide it should.
Version 2.1.12
Apple has granted every entitlement BitShout needs except one. The Endpoint Security client entitlement is submitted and in review, and it is what gates production filesystem and execution enforcement. Everything is built and passes its full suite in our lab; rather than ship claiming enforcement we have not yet verified in production, we are holding general availability until it lands.
What it needs.
Setup happens in one order, and you drive it.
Every privileged step is explicit and idempotent — running setup again repairs rather than duplicates. BitShout never bypasses a macOS consent prompt, because a security product that trains you to click through those has already lost.
Install the trusted service
The component that owns policy, grants, the broker, health and evidence.
Verify service identity and IPC
BitShout checks the service it is talking to is the service it installed.
Install the Endpoint Security extension
macOS will ask you to approve it. BitShout cannot approve it for you, and does not try.
Install the Network Extension provider
A second macOS approval, for network flow filtering.
Verify runtime state and health
Installed, approved, active and verified are four separate facts, shown separately.
Install or verify Vault runtime assets
Only if you want Vault Mode. Guard Mode does not need it.
Recompute protection health
Nothing claims to be protecting you until this passes.
Every component is signed, and identified by signature.
The app, the trusted service, both system extensions and the Vault Runtime Host are separately signed with Hardened Runtime enabled, and the release manifest records a hash for each. BitShout identifies its own components the same way it identifies yours: by signing identity, Team ID, bundle identifier, version and hash — never by path.
The host app holds only the system-extension installation entitlement. The restricted entitlements belong to the extension bundles that actually need them.