Approximate DDM Update Deadline

Simple Security Check 3.6 - Approximate DDM Update Deadline

Simple Security Check 3.6 (Build 14) adds an optional approximate update-deadline clock for each saved SimpleMDM API-key alias.

What is new

• Configure a separate days-after-release value and enforcement time for each SimpleMDM client.
• Resolve the target latest-minor macOS update against its SOFA release date.
• Show a live compact clock in Devices, including remaining, past-due, current, and unknown states.
• Show the target macOS version, resolved approximate deadline, and detailed remaining time in Device Inspector.
• Preserve API-key settings created by earlier releases when no deadline policy exists.

Configure a client

1. Open Settings in Simple Security Check.
2. Click the pencil beside the client's API-key alias.
3. Enable Calculate from SOFA release date.
4. Enter the client's deadline days and enforcement time, then save.
5. Open Devices to see the compact clock. Select a device to see the resolved date in Device Inspector.

Important boundary

The app does not read a Declarative Device Management declaration or enforcement status from SimpleMDM. The operator enters the policy that belongs to each API-key alias; SOFA supplies only the matching update release date.

The configured time is calculated and displayed in the administrator Mac's current time zone. A managed Mac may enforce according to its own local time zone. The result is intentionally labelled approximate.

FileVault Escrow and Apple Silicon Readiness

Simple Security Check 3.4 Build 12

FileVault and Recovery-Key Safety

• FileVault encryption and recovery-key escrow are now reported as separate states across Devices, Reports, Device Inspector, copied summaries, CSV, and JSON.
• Security Report flags Macs that have FileVault enabled without an escrowed recovery key and preserves unknown inventory as unknown.
• Recovery-key values are excluded from ordinary exports, diagnostic logging, and the SQLite cache.
• Revealing or copying an individual key requires Touch ID or Mac login authentication; revealed and copied values are automatically cleared.
• A separate authenticated SENSITIVE_ recovery-key CSV export uses an explicit warning, a user-selected destination, and owner-only permissions.
• Existing caches are migrated and compacted to remove recovery-key values retained by earlier versions.

Apple Silicon Readiness

• Adds an optional Compatibility Risk report with By Device and By Application views.
• Reads the optional SimpleMDM intel_inventory custom attribute populated by the public SimpleMDM-IntelInventory.sh script.
• Distinguishes Ready, Intel-only applications, Stale, Missing, and Invalid inventory.
• Adds an Intel readiness indicator to Devices and an Apple Silicon Readiness section to Device Inspector only when the selected account configures the attribute.
• Keeps the report discoverable with a link to public setup instructions when Intel inventory is not configured.

Custom Attributes and Reporting

• Adds a fleet Custom Attributes report with an attribute picker, reported values, empty or missing coverage, sortable Last Seen, and long-form CSV export.
• Adds Intel compatibility CSV export with device status, application names, scan time, architecture, and Last Seen.
• Device dashboards and reports default to newest Last Seen first, with sortable table columns where supported.

Demo Mode and Quality

• Demo Mode now provides deterministic FileVault escrow, current/stale/missing/invalid Intel inventory, Intel-only application, custom-attribute coverage, and Last Seen fixtures.
• Expands the private XCTest suite to 15 tests covering legacy and v2 Intel inventory parsing, normalization, validation, stale/risk state, Demo Mode fixtures, SOFA cache policy, and same-alias Keychain replacement.
• Updates in-app Help and documentation for the new security indicators, reports, exports, and optional Intel setup.
• Fixes Force Refresh so it bypasses and revalidates the HTTP response cache as well as the app's SQLite cache, allowing same-day SOFA releases to appear immediately.
• Reserves dedicated widths for the Devices security and Last Seen columns so FileVault, XP, and optional Intel indicators remain visible.
• Replaces ambiguous Device Inspector “Loading” labels with explicit SimpleMDM download progress, visible request or permission errors, and Retry controls. Custom attributes and installed apps now load concurrently, and invalid Intel inventory is distinct from missing inventory.
• Fixes Settings API-key rotation so an existing alias can replace its Keychain value in place; leaving the key field empty retains the current key, and duplicate aliases show a clear validation error.

Public Intel Inventory Setup

1. Create a SimpleMDM custom attribute named intel_inventory.
2. Deploy SimpleMDM-IntelInventory.sh as a SimpleMDM Script Job.
3. Store the script's stdout in the custom attribute.

See SimpleMDM Intel Inventory Setup for complete instructions.

Sparkling UI from the GUI region of MDM Reporting

Simple Security Check 3.2 Build 8

UI and Workflow

• Added a global API Key selector in the sidebar so the selected SimpleMDM API key applies across Devices, Reports, Apps, and all SimpleMDM sections.
• Removed the older per-page API key/client tabs from Devices, Reports, and Apps.
• Added first-run setup actions in Devices when no API key is configured:
  • Add API Key
  • Try Demo Server
• Added clearer title summary bars for Devices, Apps Catalog, and SimpleMDM sections with counts and short descriptions.

Devices

• Devices now has a proper Devices title instead of “Simple Security Check.”
• Added a short Devices description covering current macOS, latest minor, latest major, and security info.
• Help and docs now mention selecting a device for more detail, using Copy Device Info, and exporting all device data.
• Added XProtect status to the Devices security column when a matching SimpleMDM custom attribute exists.

Apps Catalog

• Improved the Groups column so apps assigned to many groups wrap across multiple lines instead of stretching the row horizontally.
• Long group names are constrained to readable two-line badges with full text available on hover.
• Added an Apps Catalog title summary describing MDM and Munki apps plus assignment groups.

Demo Data

• Demo Server now includes richer sample data for Devices, Apps, Profiles, Scripts, Assignment Groups, Device Groups, Installed Apps, and Custom Attributes.
• Added a demo app assigned to many groups, including long group names, to demonstrate the multi-line Groups display.
• Added demo custom attributes for XProtect, app versions, asset tags, departments, owners, security tiers, business roles, security review dates, and backup status.

Custom Attributes and XProtect

• Added Custom Attributes examples in demo data.
• Custom Attributes now show a count and short description instead of green XProtect values in the title area.
• XProtect values appear in Devices, Reports, and Device Inspector when a matching SimpleMDM custom attribute exists.
• Docs and help now point to GitHub for an example XProtect check script.

Reports

• Updated report summary styling for consistency.
• Added color to Apps Catalog report summary counts.
• All Devices report now uses the same count badge style as other report sections.
• XProtect status appears in relevant report views.

Documentation

• Updated README, User Guide, Test Mode documentation, changelog, and in-app Help for the 3.2 Build 8 workflow and UI changes.

XProtect Config Plist Data Version

v3.1 (Build 7) — Custom Attributes, XProtect Monitoring & Installed Apps

Fixed: Assignment group chips in Apps Catalog could appear squished and unreadable when a row had many groups or the column was narrow

New: XProtect Version Monitoring

• XP column in Devices table: New shield icon alongside FV / SIP / FW
  • Green shield: XProtect version matches SOFA latest
  • Yellow shield: XProtect version is behind SOFA latest
  • Red shield: attribute has invalid (non-numeric) value
  • Dash: no XProtect attribute configured
• Security Report: Devices with outdated XProtect flagged with yellow badge showing version comparison (e.g., "XProtect outdated (5345 → 5347)"). New "XProtect Outdated" count in the summary bar.
• All Devices Report: XP shield icon shown alongside FV / SIP / FW per device
• Device Inspector: Dedicated XProtect section comparing device version against SOFA latest
  • Green checkmark when current, orange warning with arrow to latest when behind
  • "SOFA Latest" reference value displayed below for easy comparison
  • Smart version matching: 4-digit values (e.g., 5347) match against XProtectPlistConfigData, 2-3 digit values (e.g., 157) match against XProtect Framework
  • Handles any attribute name containing "xprotect" — recommended: xprotect_version
  • Cleans legacy values containing extra text (e.g., "5347 (Latest: 5347)")
  • Non-numeric values show "Not a version number" instead of a bogus comparison

New: Custom Attributes

• Custom Attributes sidebar item: Browse all custom attribute definitions from SimpleMDM
  • Auto-detects XProtect-related attributes with green badges
  • Summary bar shows latest XProtect Framework and Config Data versions from the SOFA feed
• Device Inspector: All custom attribute values per device with human-readable names looked up from definitions. XProtect attributes shown separately in the XProtect section.
• Batch fetch: Custom attributes fetched for all devices automatically after refresh so the XP column populates without clicking each device

New: Installed Apps in Device Inspector

• Per-device installed app list fetched on-demand when a device is selected
• Shows app name, bundle ID, version, size, and MDM-managed badge
• Sorted alphabetically with total app count

New: XProtect Version Check Script

• xprotect-version-check.sh included in Shell script/ directory
• Gets local XProtectPlistConfigData version via /usr/bin/xprotect check
• Optional --push flag to set xprotect_version custom attribute in SimpleMDM
• Deploy via SimpleMDM Scripts to keep all devices reporting their XProtect version

Under the Hood

• SOFA feed now parses XProtectPayloads and XProtectPlistConfigData
• Per-device attribute and installed app caches cleared when switching API keys
• Demo mode generates dummy custom attributes (XProtect, Chrome, asset tag, department) and installed apps

More MDM stuff

v3.0 (Build 5) — MDM Data: Profiles, Scripts, Groups & Sidebar Redesign

New: MDM Data

Browse your full SimpleMDM configuration directly from the sidebar:

• Profiles: All managed profiles (Wi-Fi, VPN, email, restrictions, passcode) with type badges, user/device scope, reinstall-on-update flags, and device/group counts
• Custom Profiles: Custom configuration profiles with scope and deployment details
• Scripts: Expandable list showing full script content, variable support, and created/updated timestamps
• Assignment Groups: Expandable groups showing assigned apps and devices (resolved to real names), auto-deploy badges, and app/device counts
• Device Groups: All device groups from SimpleMDM

New: Group Integration

• Apps table: New "Groups" column showing which assignment groups each app belongs to (purple badges)
• Device Inspector: New "Assignment Groups" section showing which groups the selected device is in, with auto-deploy indicators

Improved: Sidebar Redesign

• Devices and Reports at the top level for quick access
• SimpleMDM section groups Apps, Profiles, Custom Profiles, Scripts, Assignment Groups, and Device Groups — each opens directly in the main view
• Settings at the bottom
• Sidebar footer shows app version and link to code.matx.ca
• No more nested navigation — every MDM view has its own refresh toolbar

Improved: Auto-fetch

• MDM data (profiles, scripts, groups) loads automatically alongside devices and apps on refresh
• Each MDM view can also be refreshed independently

Improved: Demo Mode

• Demo Server now generates realistic dummy profiles, scripts, assignment groups, and device groups for full feature testing

Under the Hood

• Generic paginated API fetch helper shared across all new SimpleMDM endpoints with automatic deduplication
• User-agent updated to 3.0

Vulnerability Check Report

v2.9 (Build 4) — Vulnerability Check, CVE Tracking & Smart Update Recommendations

New: Vulnerability Check Report

• New report in the Reports tab showing CVEs fixed per macOS release, sourced from the SOFA feed
• Shows total CVEs fixed (purple) and actively exploited CVEs (red) per release
• Expand any release to see individual CVE IDs, with actively exploited ones highlighted
• "Missing Fixes" section shows exactly which CVEs a device is exposed to when running an older version
• Links to Apple Security Notes for each release
• Default view shows only versions installed on your devices, with a "Show All Releases" toggle
• Grouped by major OS version (newest first) with "Latest" badges
• Exportable to CSV for client compliance reporting

New: Unfixed CVE Tracking

• New "Unfixed CVEs" column in the Devices tab showing how many CVEs are unpatched per device
• Color-coded: green (0), orange (some), red (100+)
• Unfixed CVE count shown in Security Report summary bar and per-device issue rows
• Included in Security Report CSV export

New: Copy Device Info

• Right-click any device row to copy a one-line summary to clipboard
• Includes name, serial, product, OS version, upgrade recommendations, unfixed CVE count, and FV/SIP/FW status
• Example: Your MacBook Pro — Serial: C02X1234 — Mac16,1 — macOS 15.7.5 — recommend upgrading to macOS 26.5.1 — 45 unfixed CVEs — FV: on | SIP: on | FW: on

Improved: Smart Update Recommendations

• Security Report now recommends actively supported macOS versions (15 and 26) instead of EOL releases
• Devices on macOS 13 or 14 show "Update to macOS 26 (Tahoe)" rather than "Minor OS update needed"
• Copy Device Info only suggests actively supported versions, never EOL releases like 13.7.8 or 14.8.7

Improved: Need Updates Report

• Renamed from "Devices Needing Updates"
• Shows upgrade paths with color-coded versions: red (current) → orange (intermediate, e.g., macOS 15) → green (latest, e.g., macOS 26)
• Only recommends the two actively supported major macOS versions

Improved: OS Version Badge Colours

• Four-tier system in the Devices tab replacing the old three-tier:
  • Green: up to date
  • Yellow: one patch behind (e.g., 26.5 → 26.5.1)
  • Orange: multiple versions behind within same major
  • Red: on an older major OS entirely

Other

• SOFA feed caching now stores the raw API response, preserving full SecurityReleases and CVE data
• Updated demo mode data with macOS 26.x versions, newer Mac models (M3/M4), and broader version spread for better feature demonstration

Apps and Reports, oh my!

List all the apps, and make Security reports

Simple Security Check v2.8 (Build 3)

New Features

• Apps Catalog — New sidebar tab to browse all apps in your SimpleMDM account. Filter by MDM, Munki, or both installation channels. Search by name, bundle ID, or version. Export to CSV or JSON.
• Reports — New sidebar tab with four built-in reports:
• Security Report: devices with outdated OS, FileVault/SIP/Firewall disabled, sorted by last seen
• Apps Catalog: all apps with channel badges and summary counts
• All Devices: complete fleet inventory with security indicators
• Devices Needing Updates: compliance dashboard with percentage score
• All reports exportable to CSV
• Device Inspector — Click any device row to open a detail panel showing full security status, OS info, identifiers, and last-seen activity
• Help Menu — Built-in help window with overview of all features and app categories
• About Window — Custom About panel with version info and code.matx.ca link

** Improvements**

• Color-coded OS version badges (green = current, orange = minor update, red = major update)
• Security shield icons for FileVault, SIP, and Firewall in a single column
• Last-seen freshness dots (green < 24h, orange < 7d, red > 7d)
• Apps load automatically alongside devices when selecting an API key — no separate refresh needed
• API key tab bar added to Reports for switching between clients
• Descriptive error messages for 401, 403, and 429 API responses
• Demo mode now generates both devices and apps for full report testing
• Dynamic version and build number in Settings and About (no longer hardcoded)