HerdOS MacBook Pro 2023 Security Checklist

Purpose
- Treat this MacBook Pro as the owner/developer workstation for HerdOS.
- Protect the code, signing keys, .env files, domain credentials, and future customer data.

Mac security baseline
- Keep macOS updated.
- Turn on FileVault full-disk encryption.
- Use Touch ID plus a strong login password.
- Turn on the macOS firewall.
- Keep Apple ID MFA enabled.
- Use a password manager for domain, hosting, database, auth-provider, Apple Developer, and Git accounts.
- Do not store production passwords, API keys, or database URLs in screenshots, notes, chat messages, or public files.
- Keep .env files private and outside public packages.
- Use encrypted Time Machine or managed encrypted backups.

Developer account protection
- Use MFA on GitHub/GitLab, Apple Developer, hosting provider, database provider, domain registrar, Auth0/Clerk/Supabase, and email.
- Use protected branches before production deployment.
- Require review before merging production changes.
- Keep production signing certificates and private keys in Apple Keychain or the provider's secure secret store.
- Never export a private signing key unless it is encrypted and stored in a controlled backup.

Build and release workflow on this Mac
- Work from the trusted HerdOS project folder.
- Before sharing a package, run syntax/security checks.
- Regenerate HERDOS-SECURITY-CHECKSUMS.json after approved code changes.
- Rebuild herdos-ready-package.zip.
- Record the zip SHA-256 in HERDOS-PACKAGE-SHA256.txt.
- Upload only the rebuilt package or deploy only from the trusted source repository.

What not to do
- Do not install random code obfuscators, npm packages, browser extensions, or developer tools from unknown sources.
- Do not run unknown terminal commands from the internet.
- Do not email .env files, signing keys, database dumps, or customer exports.
- Do not turn off FileVault or MFA for convenience.
- Do not use the MacBook hardware serial number as a customer license lock; HerdOS customers need independent phones, tablets, and replacement devices.

Future native app signing
- iOS: use Apple Developer signing, TestFlight, and App Store distribution when the mobile app becomes native.
- macOS: sign and notarize any desktop release before distribution.
- Android: use Google Play App Signing for Android releases.
