RunThis is a local macOS menu-bar app for people who intentionally paste and re-run shell commands. It is not a sandboxed or multi-user service.
| Trust boundary | Assumption |
|---|---|
| The Mac user | Fully trusted — recipes run as that user with a login shell |
recipes.json and quit artifacts |
Trusted once written; protect the Application Support folder like you would ~/bin scripts |
| Network / remote attackers | Out of scope unless they already have local file write or UI control |
| Recipe contents | Treated as executable code (Start / Status / Stop) |
- Arbitrary command execution — Saved Start, Status, and Stop strings are passed to
$SHELL -l -cwith no allowlist or prompt on start. Status commands also run when the menu refreshes. - Plaintext storage — Commands (and any secrets you paste into them) live in
recipes.json, Quit Reports, Session Snapshots, and menu titles. - Process teardown limits — Stopping/quitting Owned Processes signals the login-shell
ProcessRunThis owns; descendants may survive. Background Services are never killed on quit. - Ad-hoc signing — Local builds are not notarized; Gatekeeper may warn.
The Add sheet warns that fields are plain text. Read the Disclaimer in the README before using this software.
If you find a security issue beyond the intentional “runs my shell commands” behavior (for example: path traversal outside intended Working Directory rules, unexpected network exfiltration, or privilege escalation past the logged-in user), please open a private GitHub security advisory on this repository, or email the maintainer listed on the GitHub profile.
Please do not file a public issue with exploit details until a fix or advisory is published.