LiveHQ
Download for Mac

Host your apps. On your Mac.

Security model — current

How LiveHQ
protects your Mac.

LiveHQ publishes apps through a managed edge connection, with access checks before traffic reaches your Mac. These are the boundaries the system enforces.

Cloudflare handles public HTTPS and DDoS shielding. LiveHQ forwards authorized requests over a connection your Mac initiates. Your Mac opens no inbound application port, and its IP address is not published as the app’s DNS origin.

fig. 01 — the path of one authorized request
the internetyour mac — sole authority

—Trust boundary

A visitor connects to LiveHQ’s public edge over HTTPS. After access checks, the request travels over OriginLink to the signed runtime agent on your Mac. That agent manages the local containers and runtime credentials.

01

Client

HTTPS request

02

Privacy edge

public TLS + access policy

03

OriginLink

outbound tunnel

04

Runtime agent

signed broker

05

App + data

Docker Desktop

  1. LAW 01

    The Mac does not open an inbound application port, and its address is not published as the application origin in DNS.

    enforced by: outbound-only application publishing through OriginLink
  2. LAW 02

    Volumetric DDoS floods are absorbed at the public edge, in front of the OriginLink tunnel.

    enforced by: Cloudflare public TLS and shielding in front of the LiveHQ edge; the Mac is never the public origin
  3. LAW 03

    The Mac initiates the encrypted connection that carries authorized application traffic.

    enforced by: the signed OriginLink gateway
  4. LAW 04

    The signed Mac app and CLI never receive the Docker socket or runtime-agent Keychain material.

    enforced by: signed typed XPC; the runtime agent is the sole local broker
  5. LAW 05

    Your project is built and its image inspected before LiveHQ creates the deployment’s app or database resources.

    enforced by: one deployment plan and durable prepared-artifact evidence
  6. LAW 06

    Each app URL is bound to the correct app, Mac, and workspace through a signed route.

    enforced by: signed route bindings rather than arbitrary network targets
  7. LAW 07

    Requests forwarded to your Mac carry signed envelopes, with freshness checks and replay protection.

    enforced by: current signed request-envelope verification
  8. LAW 08

    Managed apps run in isolated containers with limited resources, no root user, a read-only filesystem, and no added Linux capabilities.

    enforced by: Docker runtime policy, network boundaries, and per-app resources
  9. LAW 09

    Runtime secrets belong to one app, use Keychain-backed storage, and are delivered when the app runs. They are excluded from image builds and redacted from diagnostics.

    enforced by: runtime-only delivery plus redaction at every output boundary
  10. LAW 10

    Your Mac proves its device identity with a nonextractable P-256 key in the login Keychain. Authorization sessions are time-limited.

    enforced by: device-bound signing through macOS security services
  11. LAW 11

    New apps start private. The edge enforces private, password, and public access before forwarding app traffic.

    enforced by: edge access policy and signed application identity

The signed runtime agent manages local execution. The edge decides which visitors may reach it.

Download for MacRead the docs