What protects you. What still depends on you.

How automated security updates work

From a published patch to your installed app, without anyone touching it.

• Detection. Dependabot checks weekly for new Electron and dependency versions, waiting three days for patches and seven for larger changes so bad releases surface first. Security advisories trigger a fix immediately.
• Verification. Each proposed update runs the unit tests, the Seatbelt sandbox test and CodeQL static analysis.
• Merge. If everything passes and it is not a major version change, the update is merged into the codebase. Major versions wait for a human.
• Release. The merge is tagged as a new version and a signed, notarized DMG is built and published automatically.
• Install. Every copy of Just Zen picks it up on next open and installs it on quit.

What is tested, and with what

• Static analysis. CodeQL and Semgrep run on every change and block the merge on any finding.
• Dependencies. Dependabot version and security updates, npm audit on every build, and a cooldown before new releases are adopted.
• Adversarial tests. Forged IPC from a foreign renderer, path traversal, symlink chains, hostile HTML and PDFs, popup containment and profile separation, run in CI on macOS.
• Sandbox tests. The Seatbelt profiles are executed for real and asserted to deny the home folder, external volumes, temporary folders and other Claude projects. Chat keeps only its own workspace's transcripts, so conversations resume.
• Review. A full code review on 8 September 2026 found and fixed thirteen issues, from Electron fuses to a Notes-only bypass. The report is in the repository.
• Red-teaming. A Promptfoo suite drives the real Chat pipeline with hostile workspace content, a careless user who approves everything, and canary secrets. Eight cases, from hidden instructions in notes to symlink tricks and exfiltration by fetch, all held on 9 September 2026.
• Network interception. Run through mitmproxy, the app refuses forged certificates outright; with TLS passed through, every destination belonged to the sites you opened, none was plain HTTP, and the sandboxed Claude only ever talked to its local egress proxy.
• Binary and runtime checks. Every executable in the signed bundle carries the hardened runtime and no debugging entitlements; Frida cannot attach to it. Ghidra found nothing beyond standard library calls in the native terminal components, and no secrets anywhere in the bundle or repository.
• Open source. The code, the review, the tooling results and every automated check are public, so anyone can inspect what runs on their Mac.

We tried to break it. Here is what happened.

On 9 September 2026 we ran five well-known security tools against Just Zen, the kind a professional tester would reach for. The technical detail is in the full write-up; this is the plain-English version.

• 1. Tricking Claude (Promptfoo). We planted notes with hidden instructions telling Claude to steal secrets, dropped fake passwords around the workspace, set symlink traps, and pretended to be a user who clicks "Allow" on everything. Claude spotted the hidden instructions and refused to follow them, and every attempt to read a secret, change a protected file, reach the home folder or send data to an outside website was blocked. Eight attacks, eight stopped.
• 2. Spying on its internet traffic (mitmproxy). We put a fake "middleman" between the app and the internet. When it tried to impersonate real websites, the app refused to connect at all. When we just watched where traffic went, the app only ever talked to the websites you had opened, nothing was sent unencrypted, and Claude's connection went through a gate that only allows Anthropic.
• 3. Checking the app is what it says it is (Apple's own tools). Every part of the app is signed by the developer and approved by Apple, with the extra hardening switched on and no back doors for debuggers. While Claude was working, we watched what files it had open: nothing from the home folder.
• 4. Taking the app apart (Ghidra). We decompiled the two small pieces of native code Just Zen ships and searched the whole app and its history for hidden keys or passwords. Nothing suspicious, nothing hardcoded.
• 5. Trying to read its memory while running (Frida). A tool that lets you reach inside a running program could not get into Just Zen at all. It could get into the unsigned developer version, which is exactly why what you download is signed.

Doing this found two real problems, both fixed in the next release: Claude's sign-in could expire after a few hours and not renew itself, and the app relied on a separately installed copy of Node.js that could break. It now renews the sign-in on its own and carries everything it needs.

Risks specific to Just Zen

• Browser vulnerabilities. Just Zen bundles its own copy of Chromium through Electron, so a new Chromium flaw can exist here until the next Electron patch ships. Sandboxing limits the impact; the automated update chain keeps that window to days.
• Windows is newer and weaker than the Mac build. The same Chromium sandboxing, process isolation, content security policy, integrity-checked app archive and disabled Node entry points apply, and saved passwords and cookies are encrypted with Windows DPAPI instead of the Keychain. Three things do not carry over yet: the installer is not code-signed (Windows SmartScreen will warn, and you cannot verify the publisher), there is no Touch ID lock, and Claude is switched off entirely because the operating-system sandbox it runs in only exists on macOS; Just Zen will not run Claude unsandboxed. The Windows build has also not been through the adversarial test suite on Windows itself.
• No independent audit yet. CodeQL and Semgrep scans, the adversarial and sandbox test suites and the code review all pass, but no third party has tested the running app. For regulated or highly sensitive work, commission an external assessment first.

What you should do

Install updates when Just Zen asks by quitting; that is the whole ritual. Connect only the folders Claude needs and prefer Read-only or Notes-only in Chat. Keep apps isolated unless they genuinely need a shared login; sites in the Shared, Personal or Work profiles can see each other's cookies by design. Turn on the app lock if the Mac is shared or ever unattended.