Giving Scripts a Capability Instead of a Secret: Testing Apple's ManagedApp Framework

A proof of concept for delivering an API credential through Declarative Device Management and letting a signed broker use it, so MDM scripts can trigger an authenticated request without ever holding the secret. Includes the signing, install-behavior, and asset-hosting problems that cost me most of two days.

October 1, 2026 · 7 min · Matt Parker

Sentinel: Building a CVE-Aware macOS Update System

Sentinel turns CVE severity into macOS update urgency: a Jamf orchestrator builds phased deployment plans, and a notifier explains the deadline to users.

January 30, 2026 · 10 min · Matt Parker