ROB Viper privacy and security scope

ROB Viper is a development preview from Orbitus Robotics. There is no public production installer yet.

The execution service records selected process and file events locally, including timestamps, executable and object paths, process identifiers, code-signing identity, CDHashes, policy results, and loss/error counters. Paths can contain personal information. It does not collect command arguments, environment values, file contents, camera data, or microphone data. Logs rotate across five files of at most 4 MiB each, with owner-only access. Exports contain the rows the operator chooses to display.

Execution controls include publisher Team ID, Team ID:Signing ID and exact CDHash Allow/Deny rules, with an explicit default action. Default-deny Lockdown and publisher trust require macOS 26 kernel signing categories. Audit allows all launches while recording would-deny results. Enforce applies policy to new executable launches; Lockdown denies unknown identities and deadline-pressure cases, while default-allow mode allows those fallbacks. macOS platform binaries and verified Viper recovery components remain allowed. Saved execution policies survive service restart. Closing the GUI does not disable enforcement; applying Monitor only removes execution authorization. Managed controls require the organization’s administrator. The exact signed host and active console owner are required to access execution controls and event data.

The network filter evaluates application and actual-process identity, destination metadata, ports, protocols and direction against explicit rules and profiles. Allow, Deny and Ask are available; Audit allows connections while recording would-deny or would-ask decisions. Ask has a bounded timeout and a configured fallback when the GUI is unavailable. Enforce denies identity-resolution deadlines or overload. No DNS, update or management exceptions are added automatically. Existing flows may continue until closed.

Connection history is optional. When enabled, it stores app/executable identities, remote IPs and available hostnames, ports, direction, timing, decisions and byte totals on this Mac. It does not request packet payloads, decrypt TLS, retain full URLs or upload browsing history. Retention is bounded by the chosen age, row limit and a 256 MiB database cap plus a bounded journal. The directory and database are private to the service; its control connection requires the exact signed host and the active console owner. Exports contain loaded visible rows and should be shared deliberately. Some short flows receive no byte totals from macOS; displayed accounting can therefore be incomplete.

A reverse-DNS lookup runs only when requested in the connection inspector. It sends the selected public IP in a PTR query to the configured DNS resolver and caches the result locally. PTR names are untrusted labels and never grant an allow rule. Domain matching requires a hostname supplied by macOS. An approved shared IP may serve several websites; the preview does not provide complete DNS-aware website identity enforcement.

Blocklist updates contact the HTTPS URL selected by the operator. That publisher sees the download request and source IP under its own privacy policy; the request does not upload connection history. Downloads are bounded, use no stored cookies or credentials, and reject malformed replacements while keeping the last valid list. The offline map uses bundled Natural Earth land shapes and an optional local DB-IP City Lite CSV. Destination IPs are not sent to a geolocation service. Locations describe approximate network endpoints, not a person’s location. Notifications are opt-in and rate-limited while Network Control is open.

Scoped live network tests verified Audit, an exact-build deny, an answered approval, reverse DNS and filtering shutdown. Separate live execution Audit tests verified publisher matching, an app-rule override and rejection of an ad hoc signing-identity impostor; those tests did not block execution. These checks are distinct from broad network, managed-fleet or multi-user security validation. The repository includes reproduction instructions for identity spoofing, policy persistence, malformed policy and blocklist inputs, prompt replay, overload, history access and the macOS service-upgrade regression.

The current agent does not automatically upload events or enroll a Mac. An organization’s MDM and inventory server has its own data collection, retention, administrator permissions, and privacy responsibilities. Installing an MDM profile is a separate, visible administrative action. Managed policies can restrict local changes; device owners should consult their organization’s support contact.

Threat Center runs separately installed ClamAV, Trivy and YARA-X under the signed-in user’s account, outside real-time policy callbacks. Scanners read the operator-selected local scope; files, package inventories and reports are not uploaded. Refreshing databases contacts the official ClamAV mirror and Trivy database registries. Trivy telemetry, external dependency lookups and project configuration are disabled for these scans. YARA-X accepts a reviewed local rule file whose hash is checked before use; remote rules are not automatically downloaded or executed.

Scan reports contain local paths, package/CVE or signature/rule identifiers, engine/rule hashes, timestamps, outcomes, coverage notes and remediation guidance. Reports and databases live in a private per-user directory. The last 20 scan reports, up to 1,000 findings each, are retained. JSON/SARIF exports are explicitly requested and can contain sensitive paths; review them before sharing. Scans have time/output limits and cancellation; missing or stale databases, skipped oversized files and failures do not establish a clean verdict.

Behavior analysis reads subscribed Endpoint Security events through its own authenticated cursor. It flags untrusted execution from staging folders, persistence-location activity and rapid rename bursts. These are investigation signals with benign explanations, not confirmed malware verdicts. Up to 200 alerts are retained for the app session; original events remain in the existing bounded event logs. Missing subscriptions and event loss are visible. Analysis and GUI schedules stop when Viper closes. Scheduling is Manual by default; daily/weekly jobs wait for configured idle/power conditions and defer under thermal pressure. No persistent job or MDM rollout is installed automatically.

The preview implements execution identity rules, application lockdown, application/destination network controls, local signature and dependency scans, and bounded behavior heuristics. It does not include a cleanup engine, a universal threat feed, complete script controls, or tamper-resistant enforcement. An allowed interpreter can run scripts; kernel signing metadata is not a full-file malware scan. Live execution blocking, managed-fleet rollout, and recovery tests must pass before production availability. Keep Apple’s built-in security protections and system updates enabled.

Security reports and questions: orbitus@orbitusrobotics.com. Please send a description first, without passwords, private keys, or unrelated personal logs. We can arrange an appropriate way to exchange a minimal reproduction.

Last updated November 6, 2026.