itsmemyan

Shipping a native Mac app here (a Rust code editor), and this matches what I see daily. My app spawns language servers, terminals, and debug adapters as subprocesses — TCC treats the whole tree as one principal, so one signed bundle means one permission set. Convenient, until you think about it: any of those subprocess binaries, if compromised, runs with my app's TCC identity. Signing and notarization buy you the bundle identity but don't solve the confused-deputy problem for the tools you shell out to. XPC services with their own bundle IDs are the cleaner answer, but that's a lot of machinery for a small team to build and maintain.