This project modifies a locally-installed Electron application. It does not run a server, collect data, or communicate with any external service beyond:
- Your self-hosted Outline instance (the URL you provide)
- npm registry (to temporarily download
@electron/asarvianpx, then removes it)
| Item | Change | Reversible? |
|---|---|---|
app.asar inside Outline.app |
One URL string in build/env.js |
Yes (--rollback) |
app-original.asar |
Created (backup of unmodified archive) | Delete manually |
| Code signature (macOS) | Ad-hoc re-signed for local use | Yes (reinstall or rollback) |
AutoUpdateDisabled pref (macOS) |
Set to YES |
Yes (--rollback or defaults delete) |
Nothing else on your system is read, written, or transmitted.
Before running, you can:
- Read it. Each script is a single file with no obfuscation.
- Run
--dry-run. Previews every action with exact commands, modifies nothing. - Run ShellCheck.
shellcheck outline-mod.shproduces zero findings. - Check CI. Every push runs ShellCheck, secret scanning, and URL normalization tests.
- Verify the SHA256. After cloning, compare against the hash shown in the latest CI run.
If you find a security issue, open a private security advisory on this repository.
Do not open a public issue for security vulnerabilities.
Release tags are signed. Verify with:
git tag -v v2.0.0