asc-appstore-release
Warn
Audited by Socket on Sep 23, 2026
1 alert found:
AnomalyAnomalyscripts/setup-mas-certs.sh
LOWAnomalyLOW
scripts/setup-mas-certs.sh
The code implements a legitimate macOS signing-certificate setup workflow. It performs expected network interaction through the configured asc CLI and handles private signing material, but it exposes sensitive credentials by printing the P12 and password and by passing the password on an openssl command line. The script should only be run in a trusted environment, and terminal logs, shell/process visibility, Desktop backups, and GitHub output capture should be controlled.
Confidence: 98%Severity: 52%
Audit Metadata