Report Apple Security Research
Overview
Write the technical evidence first and keep disclosure or program submission as a separate current-policy workflow. Make the report reproducible without overstating exploitability, affected versions, or source-level cause.
Read references/apple-security-reporting.md for the evidence checklist, version language, privacy checks, and live Apple sources.
Use research-macos-security-control first when the finding depends on exact-build TCC, sandbox, entitlement, Gatekeeper, XProtect, SIP, or system-policy implementation evidence that has not yet been separated from the supported public contract.
Workflow
Define the finding.
- State the affected component, security property, expected behavior, observed behavior, and why the difference matters.
Fix the tested environment.
- Record product and hardware model, SoC, OS marketing version and build, Xcode or SDK build, security state, and native, translated, Simulator, VM, physical-device, or research-device context.
Fix artifact and tool identity.
- Record hashes, UUIDs, bundle or component versions, signing and entitlement state, acquisition and transformation history, tool versions, scripts, and analysis projects.
Provide a minimal reproduction.
- List prerequisites, setup, exact steps, expected result, observed result, timestamps, and cleanup.
- Remove unrelated privileges, data, logging, and environmental assumptions.
Separate evidence layers.
- Direct observations.
- Generated tool output.
- Inferences and confidence.
- Unresolved alternative explanations.
Bound affected versions.
- List every build tested and use
first observed, last observed, or changed between accurately.
- Revalidate beta findings on the newest publicly available build before making a current eligibility or impact claim.
Explain impact and mitigations.
- Describe concrete confidentiality, integrity, availability, containment, or trust-boundary effect supported by evidence.
- Separate a workaround, environmental constraint, and product fix.
Prepare disclosure only when requested.
- Live-check current Apple Security Research, bounty, and research-device rules.
- Review attachments for personal, customer, secret, or unrelated diagnostic data before transmission.
Guardrails
- Do not turn a crash, static pattern, or decompiler warning into an exploitability claim without evidence.
- Do not claim an introducing or fixed build when only endpoints were tested.
- Do not claim program eligibility, reward, confidentiality, or disclosure terms from memory.
- Do not submit or transmit the report, diagnostics, or artifacts without explicit user authorization.
Output
Return a report with summary, environment, artifact identity, reproduction, observations, generated evidence, inference, impact, affected-build bounds, mitigations, open questions, and disclosure-readiness checklist.
1---2name: report-apple-security-research3description: Turn Apple-platform security research evidence into a reproducible, exact-build technical report. Use when Codex must document affected hardware and OS builds, expected and observed behavior, a minimal test case, artifact hashes, crash or sysdiagnose evidence, impact, mitigations, version bounds, beta revalidation, unresolved questions, or a handoff to the current Apple Security Research, Security Bounty, or Security Research Device reporting process.4---56# Report Apple Security Research78## Overview910Write the technical evidence first and keep disclosure or program submission as a separate current-policy workflow. Make the report reproducible without overstating exploitability, affected versions, or source-level cause.1112Read [references/apple-security-reporting.md](references/apple-security-reporting.md) for the evidence checklist, version language, privacy checks, and live Apple sources.1314Use `research-macos-security-control` first when the finding depends on exact-build TCC, sandbox, entitlement, Gatekeeper, XProtect, SIP, or system-policy implementation evidence that has not yet been separated from the supported public contract.1516## Workflow17181. Define the finding.19 - State the affected component, security property, expected behavior, observed behavior, and why the difference matters.20212. Fix the tested environment.22 - Record product and hardware model, SoC, OS marketing version and build, Xcode or SDK build, security state, and native, translated, Simulator, VM, physical-device, or research-device context.23243. Fix artifact and tool identity.25 - Record hashes, UUIDs, bundle or component versions, signing and entitlement state, acquisition and transformation history, tool versions, scripts, and analysis projects.26274. Provide a minimal reproduction.28 - List prerequisites, setup, exact steps, expected result, observed result, timestamps, and cleanup.29 - Remove unrelated privileges, data, logging, and environmental assumptions.30315. Separate evidence layers.32 - Direct observations.33 - Generated tool output.34 - Inferences and confidence.35 - Unresolved alternative explanations.36376. Bound affected versions.38 - List every build tested and use `first observed`, `last observed`, or `changed between` accurately.39 - Revalidate beta findings on the newest publicly available build before making a current eligibility or impact claim.40417. Explain impact and mitigations.42 - Describe concrete confidentiality, integrity, availability, containment, or trust-boundary effect supported by evidence.43 - Separate a workaround, environmental constraint, and product fix.44458. Prepare disclosure only when requested.46 - Live-check current Apple Security Research, bounty, and research-device rules.47 - Review attachments for personal, customer, secret, or unrelated diagnostic data before transmission.4849## Guardrails5051- Do not turn a crash, static pattern, or decompiler warning into an exploitability claim without evidence.52- Do not claim an introducing or fixed build when only endpoints were tested.53- Do not claim program eligibility, reward, confidentiality, or disclosure terms from memory.54- Do not submit or transmit the report, diagnostics, or artifacts without explicit user authorization.5556## Output5758Return a report with summary, environment, artifact identity, reproduction, observations, generated evidence, inference, impact, affected-build bounds, mitigations, open questions, and disclosure-readiness checklist.
gaelic-ghost