LockPlus 2.0.2

LockPlus 2.0.2

A security release. One behaviour change first:

• Profiles start from LockPlus. Starting a profile from System Settings › VPN or with scutil --nc start now only
  works for the profile you picked for Auto-Connect while Auto-Connect is on. Any other start from outside is refused
  with "Connect it from LockPlus". This also stops other users on the same Mac from connecting your profiles with your
  saved credentials. Connecting from the LockPlus window or the menu bar works as before.

New

• Open profiles from Finder. Double-click a .ovpn, use Open With for .conf and .zip, or drop files on the Dock
  icon. You get the usual import preview; nothing is saved until you confirm.
• Test Connection (Diagnostics, ⌘R, or the link in the protection panel while connected) checks that IPv4, IPv6 and
  DNS go through the tunnel. It contacts only LockPlus's own test page, and only when you start it. It says "through the
  tunnel" or "blocked" only when the test proved it. It doesn't check the address websites see.

Security

• Profile checks moved into a sandboxed helper. Importing, editing and checking profiles now happens in a separate,
  sandboxed helper inside the app, with no network and no file access. The tunnel component, which runs as root, no
  longer parses untrusted profiles with the OpenVPN engine.
• The tunnel component only talks to LockPlus builds at least as new as itself.
• The end of a pause, the end of an update and the Auto-Connect setting are sealed with a key in your keychain and used
  once, so another program can't use them to start a profile.
• Zip import limits are now 1 MB per profile and 64 MB unpacked.
• The "Import QR Code Image…" items are gone; QR import never worked.

Plus many fixes around restarts of kill-switch sessions, Save Only while connected, and the 2.0.1 display issues (a
refused start right after launch now says why; a second, waiting configuration is noted when it starts). The full list is
in the CHANGELOG.

How this release was checked. Since 2.0.1, every security-relevant change is reviewed by two independent AI review
engines from different model families (Anthropic's Fable and OpenAI's Codex), round after round until neither reports a
high-severity issue. For 2.0.2 that took seven rounds; where a fix kept producing new findings, it was removed and the
smaller remaining limit documented instead. End-to-end runs on macOS 26 and 27 virtual machines checked it on the real
system; the first release candidate's run found two bugs the reviews couldn't see (the profile checker crashed in the
signed build, and a paused profile didn't reconnect without the app), both fixed and re-reviewed before this release. The reports and every known limit are public in
docs/reviews/ and
DESIGN.md §20. As always: an AI review is not a
human audit.

Known issue (also in 2.0.1). After LockPlus quit unexpectedly, Edit Config… may open no editor until the next normal
start. Quit LockPlus with ⌘Q and open it again. The fix is planned for 2.1.

Downloads

File	SHA-256
LockPlus.dmg	f5fba87d4f9255ec6dc685c455b1b74b7a2213351a5b3bea2fa2555a56cc9b02
LockPlus-2.0.2.zip	9714162dd761e3eb2fc41409631fcd3e2f93357a82b9baf1b306f7a6b14c8c90
0001-LockPlus-ClientOptions-can-leave-openvpn3-s-process-.patch	bab08174b1b711219e0c79933a38911734997bfd6d202386f2fc390b3858e4c2

macOS 26 or later, Apple silicon. LockPlus 2.0.x users get this update in the app; Homebrew users too
(auto_updates). The OpenVPN 3 patch is unchanged since 2.0.0.

LockPlus 2.0.1

LockPlus 2.0.1

A maintenance release. The main fix is about a second LockPlus profile started outside the app.

• A second LockPlus profile no longer silently takes over a running connection. If a second LockPlus profile was
  started outside the app (System Settings › VPN, scutil, or an on-demand rule) while another one was connected, the
  first connection stopped passing traffic while macOS still showed it as connected; with the kill switch on, the Mac
  stayed offline until you disconnected it. Nothing leaked, but the status was wrong. Now:
  • the second start is refused with a clear message, and the running connection keeps working;
  • the kill switch has priority: a profile with the kill switch may replace a running profile without it (that
    profile is told why it was disconnected); two kill-switch profiles never replace each other;
  • the app keeps showing the connection that is actually running.
• Onboarding: "Allow VPN configuration" moves on with one click, and choosing files in the profiles step opens the
  import report as it should.
• Diagnostics explains refused or replaced starts, and a second configuration of a profile that was started outside
  LockPlus.
• After an update, the main window opens once, as documented.

How this release was checked. The fix went through repeated independent security reviews by two different AI model
families (Anthropic's Fable and OpenAI's Codex), each round's findings fixed before the next, and end-to-end runs on
macOS 26 and 27 virtual machines. The reports and their fixes are in
docs/reviews/. As before: an AI review is not a human
audit.

Known display issues (fixed in 2.0.2, nothing leaks): on macOS 26, a start refused right after LockPlus launches
may show no reason; the Diagnostics note about a second, waiting configuration can appear only minutes later; on macOS 27,
a waiting second configuration can make the profile's row show "Connecting…" while the connection is up.

Downloads

File	SHA-256
LockPlus.dmg	e13a96749ba1d371752ee3accd1ef2b983b35a20a8d81f91f0595b90d9eaf5d6
LockPlus-2.0.1.zip	cf8e57ee8a3e995145b1dcdee704ab9759c5fbd434c791e73b24d7c3c99a1ebf
0001-LockPlus-ClientOptions-can-leave-openvpn3-s-process-.patch	bab08174b1b711219e0c79933a38911734997bfd6d202386f2fc390b3858e4c2

macOS 26 or later, Apple silicon. LockPlus 2.0.0 users get this update in the app; Homebrew users too
(auto_updates). The OpenVPN 3 patch is unchanged since 2.0.0.

LockPlus 2.0.0

LockPlus 2.0.0

LockPlus has been rebuilt from scratch as a native macOS app. Same idea, a WireGuard and OpenVPN client with a kill
switch, now built on Apple's Network Extension: no root helper, no firewall rules, and a kill switch that macOS
itself enforces.

I built LockPlus because I needed one Mac client for WireGuard and OpenVPN and found none I liked: none with a real
kill switch for both protocols and a UI I'd want to look at every day. LockPlus 2 is that app done properly.

How it is built. I direct the work, decide and am accountable; most of the code is written by AI coding agents
(Claude). Every security-relevant change went through dedicated AI security review passes, published with their
fixes in docs/reviews/. About 880 automated tests
and end-to-end runs on macOS 26 and 27 virtual machines verify it, with documented results. An AI review is not a
human audit: independent review and issues are welcome.

Highlights

• Native app. SwiftUI and AppKit, in the menu bar and a main window. The tunnel runs in a system extension that
  you approve once in System Settings. No administrator password to connect, no background daemon.
• Kill switch enforced by macOS. With the kill switch on, macOS blocks every packet outside the tunnel, also while
  the tunnel reconnects. "Disconnect and Restore Internet" always gets you back online.
• WireGuard and OpenVPN in one app, with OpenVPN sign-in by password, static challenge (one-time code) and
  dynamic challenge (CRV1), including a new code on reconnect.
• Auto-connect on networks you don't trust (Wi-Fi and/or Ethernet) with a trusted-networks list. It works through
  macOS's on-demand rules, also while LockPlus isn't running.
• Pause Protection for a set time, for hotel and café sign-in pages; it resumes by itself.
• DNS verification: "DNS through tunnel (verified)", or what is wrong.
• Honest status everywhere: Protected, Not protected, Blocked, Paused, Sign-in needed, each with its own icon.
  "Protected" only when macOS says the tunnel is connected.
• Menu bar with live rates, a status header with a rate graph, one-click switching.
• Import with a report (.conf, .ovpn, zip, the WireGuard app's export) and a built-in editor with checks.
• Diagnostics (routes, DNS, tunnel checks) and an export with secrets removed.
• English and German.
• A new app icon for macOS 26: the familiar padlock, now adaptive: off-white in Light, navy in Dark, plus Clear and Tinted.

Upgrading from LockPlus 1.x / WireGuide+

LockPlus 2 is a new app; LockPlus 1 can't update itself to it. The way over is LockPlus 1.2.0, the last version of
LockPlus 1: it shows what LockPlus 2 will copy, and Move to LockPlus 2 now disconnects, removes the old background
helper (one administrator password prompt), downloads LockPlus 2 and checks its signature before opening the installer.
Later keeps LockPlus 1 working, with a banner to move when you're ready. On first launch LockPlus 2 copies your
profiles and settings; your 1.x files are never changed.

Check your version first (LockPlus or WireGuide+ › About):

You have	How you get 1.2.0
1.0.65 – 1.1.0	The in-app update offers 1.2.0, verifies it and shows the downloaded zip in Finder. Open it and drag LockPlus to Applications (Replace).
1.0.28 – 1.0.62 (WireGuide+ 1.0.28 – 1.0.56, LockPlus 1.0.57 – 1.0.62)	The in-app update offers 1.2.0 and shows the downloaded DMG in Finder. Open it and drag LockPlus to Applications. WireGuide+ users: the new app is called LockPlus and sits next to WireGuide+; quit WireGuide+ first.
1.0.63 – 1.0.64	The in-app update can't check 1.2.0's signature and opens the releases page instead. If the in-app update fails, download the DMG (lockplus-v1.2.0-darwin-arm64.dmg) and drag LockPlus to Applications.
1.0.0 – 1.0.27 (WireGuide+)	The update check of most of these versions looks at the original WireGuide project, so it may not offer 1.2.0 (1.0.0 even offers "WireGuide 0.6.1": that is a different app, don't install it). If yours doesn't offer 1.2.0, download manually: with macOS 26 and Apple silicon, take LockPlus 2 directly; otherwise the 1.2.0 DMG.

No 1.x version replaces the app by itself: every update ends with you opening the download and dragging LockPlus to
Applications. Then open the new LockPlus once.

Requirements. LockPlus 2 needs macOS 26 and Apple silicon.

• On macOS 13 – 15, update to 1.2.0 and choose Later: LockPlus 2 won't start on your system, and 1.2.0 keeps
  working.
• LockPlus has been Apple-silicon-only since 1.0.23. On an Intel Mac neither 1.2.0 nor 2.0 runs; WireGuide+ 1.0.22 was
  the last Intel build.

Homebrew. brew upgrade --cask lockplus, then quit and reopen LockPlus (Homebrew doesn't relaunch it). The old
wireguide-plus cask is renamed to lockplus, so brew upgrade moves you over. If you used LockPlus 1.x, open it
once before the cask moves to LockPlus 2, so its helper is removed.

WireGuide+ background helper. WireGuide+ 1.0.1 – 1.0.56 installed a background helper of its own
(io.github.steiale.wireguide-plus.helper). If you came from WireGuide+, check for it after moving and remove it in
Terminal (disconnect and quit WireGuide+ first):

sudo launchctl bootout system/io.github.steiale.wireguide-plus.helper 2>/dev/null
sudo rm -f /Library/LaunchDaemons/io.github.steiale.wireguide-plus.helper.plist \
           /Library/PrivilegedHelperTools/io.github.steiale.wireguide-plus.helper

Then you can move WireGuide+ to the Trash.

What is copied from LockPlus 1.x

• All WireGuard and OpenVPN profiles, each checked by the new importer (the report lists anything that changed or
  isn't supported);
• the kill switch setting per profile (route protection for split tunnels) and DNS through the tunnel;
• Wi-Fi auto-connect: the auto-connect profile, untrusted-network setting and trusted networks;
• connection history;
• saved OpenVPN user names, and saved passwords if you allow it (one keychain prompt per item);
• language, appearance (Light, Dark or System), log level, menu bar icon style, and "open at login" (offered, never
  switched on silently).

Not copied: per-network profile choices (a different profile per Wi-Fi; not supported yet). LockPlus 1's files are never changed; you can re-run the import later from
Settings › Advanced › Import from Old LockPlus….

Known limitations

• Crash window. If LockPlus's tunnel process crashes with the kill switch on, macOS lets traffic through for under
  2 seconds (1.3 to 1.7 s measured on macOS 26 and 27) before it restarts the tunnel. For the auto-connect profile, the running app restarts it within about
  1.5 seconds; without the app, the Mac stays online until the next network change.
• Switching profiles is a short unprotected moment (LockPlus runs one tunnel at a time).
• One active tunnel at a time. LockPlus 1 could run several WireGuard tunnels at once.
• No separate DNS protection switch: with the kill switch on, DNS goes through the tunnel.
• Split tunnels get route protection, not a full kill switch.
• OpenVPN: no TAP, plugins or web (SSO) sign-in; outdated ciphers (BF-CBC, DES, 3DES) and auth MD5 aren't
  supported (AES-CBC works, with a "Legacy encryption" note).
• macOS always lets some system traffic bypass VPNs (network setup such as DHCP, captive-network sign-in, and by
  default Apple push notifications and cellular services).
• A VPN server reachable only through a secondary interface (a local VM or Docker network) can't be used.

System requirements

• macOS 26 (Tahoe) or later
• Apple silicon (Intel Macs aren't supported)

Checksums

File	SHA-256
LockPlus.dmg	28096c8fee5ae917031282e75cc09a732892e91086acd632df5a2221193ae583
LockPlus-2.0.0.zip	1cb993fc1a57ef5fb7ad8f45d93ff9a20830d341f6a69156f7a8ebc21580b1d4
0001-LockPlus-ClientOptions-can-leave-openvpn3-s-process-.patch	bab08174b1b711219e0c79933a38911734997bfd6d202386f2fc390b3858e4c2

Both artifacts are signed with Developer ID (team M53GHX9FAY) and notarized by Apple; the zip also carries the
Sparkle EdDSA signature in the update feed.

Open source notices

LockPlus is MIT-licensed; source: https://github.com/steiale/lockplus. It includes OpenVPN 3 (MPL-2.0), OpenSSL
(Apache-2.0), wireguard-go and WireGuardKit (MIT), Sparkle (MIT), ZIPFoundation (MIT), LZ4 (BSD-2-Clause) and Asio
(Boost Software License).

Source of modified MPL files: this release ships OpenVPN 3 release/3.11.8 with one local change (a data race on
process-wide settings). The patch is attached to this release
(0001-LockPlus-ClientOptions-can-leave-openvpn3-s-process-.patch) and is in the source repository under
native/Vendor/patches/openvpn3/.

---