Nick v1.1 — Detection Hardening & UI Overhaul

Nick v1.1 — Detection Hardening & UI Overhaul

Security Fixes

• Fixed supply-chain bypass in trust downgrade — persistence alerts are never
  downgraded regardless of trusted process involvement
• Replaced all path-based exclusions with signature-based verification — files
  are only trusted if the parent app bundle is properly signed by Apple or a
  known developer
• Trusted process verification now checks code signature, not just process name —
  prevents impersonation by renamed malicious binaries
• Fixed raw IP outbound false positives — excluded 0.0.0.0, link-local (fe80::),
  ULA (fd/fc), localhost, and private network ranges from alerting
• Fixed launchd (PID 1) failing signature validation

New Features

• Main application window with sidebar navigation (replaces menu bar panel)
• Deep Scan — full-system YARA scan with progress tracking, verdict classification,
  and export reports
• Drag-and-drop file scanning in the Scan tab
• Persistence view with status filters (All/Verified/Missing/Broken) and right-click
  context menu (Show in Finder, Copy Path, Remove)
• Login Items monitoring via System Events
• Shell profile monitoring (~/.zshrc, ~/.bash_profile, /etc/zshrc)
• SSH authorized_keys monitoring
• System hardening alerts for firewall, stealth mode, remote login, and XProtect
• Foundation Models threat explanations on all alerts (macOS 26+)
• Onboarding welcome screen with permission guidance
• Firewall allowed apps audit — flags stale, unsigned, or non-standard entries
• Notification "View in Nick" action
• Audit deep links to System Settings
• "Scan with Nick" Finder Services integration

Improvements

• Scan progress overlay with per-stage tracking
• Overview dashboard with security gauge, sparkline charts, protection summary,
  and recent activity feed
• Settings window redesigned with grouped sections
• Alert cards show file path, PID, Kill Process, and Show in Finder actions
• Deep Scan verdict classification: Threats, Suspicious, Application Data,
  Development Artifacts
• Window hides on close (red button) instead of quitting — menu bar icon reopens
• SwiftData schema versioning for future migrations
• UserDefaults registered with sensible defaults
• SonarCloud and Codecov integration

Bug Fixes

• Fixed scan blocking main thread (actor refactor)
• Fixed ProcNetHelper port overflow for ports ≥ 32768
• Fixed ProcNetHelper bindMemory alignment crash
• Fixed notification permission never being requested
• Fixed "Checking..." stuck state in process signature column
• Fixed empty function SonarCloud warnings
• Removed dead DashboardView code from menu bar panel era
• Zero compiler warnings

Requirements

• macOS 26 or later
• Apple Silicon or Intel Mac

Verification

codesign -dv --verbose=4 /Applications/Nick.app 2>&1 | grep Authority
spctl -a -vv /Applications/Nick.app
shasum -a 256 Nick-v1.1.dmg
Expected: f532a5fd8d8733df5d19477e204071679838a944575331b9761744b462180616

Security

Report vulnerabilities via GitHub Security Advisories
or security@3nsofts.com.