v1.1.5

SecureAppLocker v1.1.5

This update brings a critical security patch to the system hardening feature and some much-needed quality-of-life improvements to the Audit Logs dashboard.

🛡️ Security Updates

• Task Manager Included in System Hardening
  Task Manager (taskmgr.exe) is now automatically locked when you enable the System Tools Hardening switch. Previously, this had to be locked manually by the user, leaving a major vulnerability where local admins could forcefully stop the locker's background service. Now, it is fully covered by default under the hardening umbrella.

✨ UX & Quality of Life

• Audit Logs Management ("Clear All" & "Ignore")
  We've made it much easier to keep your blocked ghost processes list clean. Because logs used to accumulate permanently unless explicitly trusted, the dashboard would get cluttered quickly. You can now use the new "Clear All" button to instantly wipe the entire log history, or use the "Ignore" button on individual entries to simply dismiss irrelevant logs from your view without adding them to your trusted rules.

v1.1.4

SecureAppLocker v1.1.4

This update introduces surgical precision to how you handle temporary executions and dynamic rules, making the Zero-Trust environment much smoother for daily administrative tasks and software installations.

New Features

• Context Menu "Trusted Run" Integration
  We have integrated a new "Run via SecureAppLocker" option directly into the Windows right-click context menu. This feature allows you to launch any executable with a temporary, one-time "Parent Immunity" after verifying your master password. You can choose to execute the file with standard user rights or elevated administrator privileges. This serves as the perfect solution for running one-off installers, updaters, or trusted scripts without having to permanently add them to your whitelist or lower your system's overall security posture. Once the application closes, the temporary clearance vanishes.

• Wildcard (*) Support for Trusted Exceptions
  The Audit Logs and Trusted Commands system now fully supports wildcard characters. Modern installers frequently extract themselves into temporary folders using dynamically generated version numbers or random strings (e.g., VSCodeUserSetup-x64-1.132.0.tmp). Instead of constantly updating your exception lists with new file names, you can now define a rule using an asterisk, such as VSCodeUserSetup-*.tmp. The engine automatically converts this into a secure regex pattern, granting seamless access to future updates while keeping your blocked ghost processes list completely clean.

Best Practices & Recommendations

• Handling Bulk Package Managers (Winget, Scoop)
  When using command-line package managers to perform bulk application upgrades, the operating system often breaks the process tree by delegating the actual installation tasks to background OS services or COM objects. Because of this architectural broken chain, parent-child immunity cannot reliably propagate to the extracted setup files.

  If you have System Tools Hardening enabled, these bulk updates will likely be intercepted and blocked. To ensure a smooth experience, we recommend temporarily disabling the Master Protection Switch (or activating the 5-minute Global Unlock mode) from the Manager UI before initiating bulk upgrade operations with Winget, Scoop, or similar tools.

Full Changelog: 1.1.3...1.1.4

v1.1.3

SecureAppLocker v1.1.3

This release focuses on tightening system-level security and introducing a transparent, zero-trust approach to background process management.

New Features & Improvements

System Tools Hardening
We added a dedicated setting to instantly protect critical operating system binaries. This was implemented to prevent local administrators from easily bypassing the locker or terminating the background service. Since forcefully killing the service via Task Manager results in a BSOD, restricting access to tools like Command Prompt, PowerShell, MMC, and Registry Editor eliminates alternative termination vectors. This leaves Safe Boot as the only viable bypass route for a local admin.

• How to use: Navigate to the "Security" tab and toggle "Lock OS Management Tools". This will automatically add the targeted system tools to a managed protection list. You can view these managed tools under your standard app list in the "Apps" tab.

Strict Parent-Child Process Validation
The background service now uses NTDLL to accurately trace the execution tree of any launched process.

• How it works: If a locked application (e.g., powershell.exe) is spawned by a parent process that is either currently unlocked or explicitly trusted, the password prompt is bypassed. This ensures that your legitimate development environments or wrapper scripts can function uninterrupted in the background while unauthorized calls remain blocked.

Audit Logging & Trusted Exceptions UI
This feature provides precise control over the conditions under which locked applications can be invoked by other programs. By default, background tasks and third-party apps (such as a browser extension calling cmd.exe) are blocked from launching protected tools.

• How it works: When an unauthorized background call is intercepted, the service silently kills the process and logs the event instead of throwing a disruptive password prompt on your screen.
• How to use: Open the new "Audit Logs" tab to view a list of blocked background processes, complete with their parent names and exact command-line arguments.
  • Click Trust Parent to whitelist the parent application, allowing it to freely spawn locked tools.
  • Click Trust Command to whitelist a specific command execution. Note: When trusting a command, a dialog will appear allowing you to trim the command line. Make sure to remove dynamic parameters (like random session IDs or pipe names) and keep only the static, unique keywords (e.g., xdm-app-host.exe) so the rule works on future executions.
  • You can review and revoke any of these granted permissions in the "Trusted Exceptions" section at the top of the Audit Logs tab.

State Management & SafePID Resets
Internal process caching has been tightened. SafePIDs and active application immunities are now immediately purged and reset whenever the configuration is updated or the Windows session is locked. This ensures no permissions are left lingering as zombie states.

v1.1.2

🔒 SecureAppLocker v1.1.2

Just pushed v1.1.2 with a quick quality-of-life update:

• Instant Lock (0-Minute Timeout): You can now set the timeout to exactly 0 in the settings. This means the moment you close a protected app, it locks immediately—no lingering unlock window.

A quick dev note on how this works under the hood: I couldn't make the delay literally 0 seconds. If the system granted a 0-second authorization right after you type your password, that authorization would expire in the exact same millisecond.

Because of how Windows handles processes, it takes a brief moment for the app to actually launch, grab a PID, and get recognized by our background service. If the timeout was a true zero, the watchdog would just kill the app before it even opened, causing an infinite lock loop.

To get around this, setting the timeout to '0' actually gives the app a hidden 15-second grace period—just enough time for it to boot up and get whitelisted. Once it's running, it stays open as long as you need. But by the time you finally close the app, those 15 seconds are long gone, so the system locks it down again instantly.

v1.1.1

🔒 SecureAppLocker

Changes in this build:

• 📝 Logging & UI Toggle: We added an audit log system (C:\ProgramData\SecureAppLocker\audit.log) that records blocked apps and password attempts in the background. If you'd rather turn it off, there's now a toggle switch right under the Security tab in the Manager UI.

v1.1

SecureAppLocker

• project migrated to .NET10
• Named Pipe LAN protection was added, and ProgramData permission was removed for standard users.
• Migrate password hashing and recovery key storage to Windows DPAPI

Setup

• Added Service Recovery task (When a service crashes, Windows now restarts it within 60 seconds.)
• A "confirm password" field has been added to the password setting screen for uninstaller.

1.0.0

🎉 v1.0.0 - Initial Stable Release

I am incredibly proud to announce the very first stable release of SecureAppLocker (v1.0.0)! 🚀

This release marks the culmination of meticulous development, complex architecture design, and rigorous testing. SecureAppLocker is built to provide a robust, fail-secure, and lightweight application locking experience for Windows, seamlessly bridging a SYSTEM-level NT Service with a beautifully modern WinUI 3 interface.

⚠️ CRITICAL: Read Before Installing

1. Default Master Password: Upon first launch, the manager and prompts will require a master password. The default password is 1234. Please change this immediately in the settings and backup your offline recovery key!
2. Uninstall Password: During the setup process, the installer will ask you to create an Uninstall Password. This is a permanent, SHA-1 hashed security measure to prevent unauthorized removal of the software from your system. Do not lose it!

✨ Key Highlights of v1.0.0

• Fail-Secure Architecture: If the password prompt UI is forcefully closed or crashes, the background service enters Lockdown Mode, instantly killing the target application to ensure zero data leaks.
• Smart Metadata Detection: Bypassing the locker isn't as simple as renaming an .exe. The engine hooks into the internal OriginalFilename and ProductName metadata to identify applications accurately.
• Active Process Immunity: Intercepts newly launching apps without aggressively killing your active work. Once an app is unlocked, its main executable and child processes are granted temporary immunity.
• Zero-Trust Session Lock: Integrated directly with Windows Terminal Services (WTS). Pressing Win+L to lock your Windows session instantly wipes all active app unlock caches.
• Adjustable Micro-Polling: You have full control over the process scanning interval (down to 50ms) for the perfect balance between CPU performance and millisecond-level interception.
• Master Protection Switch: A global toggle on the WinUI 3 dashboard to instantly arm or disarm the entire locking system for heavy workflows or gaming sessions.
• Session-Independent IPC: Bulletproof communication between Session 0 (NT Service) and Session 1 (User UI) using Named Pipes.

🐛 Known Behaviors

• Startup Synchronization Delay: The SYSTEM service starts protecting your PC the second it boots. However, the UI prompt starts with your user login. If you launch a locked app immediately upon seeing the desktop, it will be killed instantly, but the password prompt might take a few extra seconds to appear while Windows loads background startup apps.

📥 Installation

1. Download the SecureAppLocker_v1.0.0_Setup.exe from the Assets below.
2. Run the installer (Requires Local Administrator privileges).
3. Set your custom uninstall password.
4. Open SecureAppLocker Manager, log in with 1234, and start securing your digital workspace!

---

Thank you for checking out the initial release of SecureAppLocker! If you encounter any edge cases or bugs, please feel free to open an issue. 🛡️