Magic Toolbox v1.0.1

This release is the result of a full internal security audit of Magic Toolbox, alongside two new tools and a long list of reliability fixes across almost every tool in the app.

New features

• Profile Signer – Sign .mobileconfig configuration profiles locally using a code-signing certificate from your keychain.
• Profile Unsigner – Strip the signature from a signed .mobileconfig, producing a plain, editable profile.
• MDM Reporting Tool launcher – A new Home screen tile for quick access to the companion MDM Reporting Tool app, configurable from Preferences.
• Wipe: Dry Run mode – Preview the full deletion plan and report before anything is actually deleted.
• Disable: Undo – Revert a Disable run from its automatically created backup.
• Clone: pre-overwrite backups – Destination objects are saved to an encrypted backup before they are overwritten.
• Restore: "Update existing objects" mode – Restore from the pre-overwrite backups that Clone now creates, updating the existing objects in place.
• Clone: "Select/Deselect Matching" – Quickly select or deselect all currently filtered results.
• Compare: case-insensitive name matching – Optional when comparing objects across multiple instances.
• Account Audit: account groups – Now covers groups, including directory/LDAP groups that grant admin access to all their members, not just individual accounts.
• New Preferences sections – Choose which certificate Profile Signer uses, and configure the location of the MDM Reporting Tool app.
• Safer app exit – If you try to quit or close the window while a destructive operation (Wipe, Disable, Restore, etc.) is still running, Magic Toolbox now asks whether to keep it running or close anyway, instead of killing it silently.

Security fixes

Credential and licence handling

• Saved Jamf credentials in the Keychain now require the Mac to be unlocked for every read, and deleting a saved server cleans up every copy of its credentials instead of leaving stale copies behind.
• Credential forms now only write to the Keychain when you explicitly save, rather than on every keystroke.
• Licence checks no longer use your Mac's hardware serial number as an identifier, now re-validate automatically every few hours instead of only at launch, and can no longer be bypassed by rolling back the system clock. The licence server now also rate-limits and validates incoming requests.
• Your Jamf API session token is no longer forwarded if a request is redirected to a different host, and is only attached to secondary downloads (like icons) when going back to your own Jamf server over HTTPS.

Destructive operations (Wipe, Unused, Clone, Disable, Restore)

• Encrypted backups are now verified by decrypting them immediately after they're written, before any deletion or change proceeds.
• Wipe, Unused and Disable now detect and protect the Jamf account or API client your current session is using, so you can't accidentally disable or delete the credentials you're working with.
• Items that couldn't be read are now treated as "do not touch" rather than assumed safe to delete, and destructive bulk actions require typed, name-matched confirmation.
• XML responses from Jamf are now parsed with external entity loading disabled, closing an XXE injection path.

File and data handling

• Inspector now performs real cryptographic signature verification on packages instead of just detecting that a signature block is present. It also enforces limits to block "zip-bomb" style packages, blocks path-traversal ("zip-slip") entries on export, and no longer follows symlinks or opens special files outside an inspected app bundle.
• Downloader now keeps downloaded files confined to the folder you chose.
• Filenames used in uploads and downloads are sanitised to prevent header injection.
• Exported CSV reports are now escaped against formula/CSV injection, and HTML reports ship with a Content-Security-Policy and stricter escaping.
• PPPC profile generation is now blocked if it would embed a missing or placeholder code signature.

Information exposure

• Sensitive values (API/SSO tokens, pre-shared keys, certificates) are now masked in Profile Conflicts results and exported reports.
• The in-app debug log now redacts a wider range of secrets (Basic auth, JWTs, licence keys, OAuth tokens).

Improvements

• Wipe, Unused, Clone, Disable and Restore now keep a persistent, crash-surviving action log, visible from the results screen.
• Pagination fixes mean large Jamf instances are no longer silently truncated in several audit and report tools.
• Partially successful scans and exports now clearly show "Incomplete" instead of silently reporting clean.
• Several scanners now run off the main thread for a more responsive UI.
• Backup passphrases now require a minimum length and confirmation, with a strength meter.
• The About screen shows your actual installed version and build instead of a hardcoded "1.0".

Bug fixes

• Config Profile Conflicts – Profiles that failed to load are no longer treated as conflict-free; Mac and mobile profiles sharing an ID are no longer confused.