SafeExamBrowser/seb-mac 3.7b1

Safe Exam Browser 3.7 Beta 1

on GitHub

Release notes for Safe Exam Browser version 3.7 for macOS:

SEB 3.7 contains many important security improvements, a new Wi-Fi control especially helpful with AAC Assessment Mode and various fixes.

New in SEB 3.7b1 (Build 15735)

• Now the macOS Automatic Assessment Configuration (AAC) Assessment Mode is the default lockdown/kiosk mode. Choosing the kiosk mode is controlled with the new setting lockdownModePolicy described below.

• Added a Wi-Fi control (widget) to the SEB Dock, which is automatically displayed when using the AAC Assessment Mode and the macOS menu bar is hidden by settings. This lets users see the current Wi-Fi network and switch to another network during a session without access to the menu bar. When connecting to a network for the first time, SEB prompts for the network password (or a user name/password to read it from the Keychain) and stores it in a dedicated SEB Keychain item for subsequent connections to the same network. The Location Services permission alert (required to display Wi-Fi network names) now closes automatically once access is granted in System Settings. The new setting hideWiFiControls (currently macOS only) allows to hide this control (see below for details).

• Now detecting and terminating applications which have been granted macOS Accessibility permissions (which could be misused to remotely control the Mac or automate other apps) before and during an exam session. To be able to detect such apps, SEB requires Full Disk Access. If it is not granted, SEB asks the user to enable it in System Settings / Privacy & Security / Full Disk Access.

• Now preventing Live Activities from an iPhone (for example a live sports score or timer, but also tools which could be used for cheating) from being displayed on the Mac (in the menu bar) during an exam session.

• Implemented macOS 26 clipboard (pasteboard) history blocking also for the Classic (non-AAC) kiosk/lockdown mode (previously this was only handled when using the AAC Assessment Mode).

• Allow to open Settings when starting SEB for the first time/with default client settings now works correctly. This solves access to settings if you want to set up SEB manually (as the setting "Allow to open Settings window on client" is by default disabled/false since SEB 3.6).

• Fixed: When reconfiguring from SEB settings which have AAC active (for example when using default SEB Server connection settings), some system alerts are hidden. This mostly applied to the macOS Screen Recording and Accessibility permissions dialogues. SEB was then stuck and the Mac had to be force-restarted.

• Fixed: User Agent string with trailing space causes web app error. As a workaround, if you cannot update to 3.7 yet, add some short user agent suffix, which is always appended at the end of the user agent string, which SEB is sending.

• Fixed: SEBClientConfig.seb in Preferences folder leads to red screen “Re-Opening Locked Exam!”.

• Fixed: Can open spellcheck window from Dictation popup in AAC.

• Fixed: Some websites using the SEB Javascript API crashed on older macOS versions.

• Remove outdated settings when Saving As in the Settings window.

• Added many additional preset prohibited processes, including remote access/control tools (for example RustDesk) and further apps which request Accessibility permissions, as well as prohibited processes which were missing compared to SEB for Windows.

• Optimized the code signature validation of running system processes. The check is now macOS version independent (also works on macOS 27).

• Fixed: Modal alerts were displayed hidden behind SEB windows / the black background covering the screen after a transition from the AAC Assessment Mode to the Classic kiosk mode.

• Fixed a crash during shutdown (caused by modifying the list of terminated processes while it was being enumerated).

• Improved logging (reduced repetitions and improved meaningfulness of log events). SEB now logs the list of running applications at session start (also when using the optional SEB Server) instead of at app start.

• Changed the SEB source code license to the Mozilla Public License 2.0 (MPL 2.0) and updated the copyright year to 2026.

Optional features which need to be individually configured and are disabled by default

• Screen Proctoring now also works together with the macOS AAC Assessment Mode, offering two different screen capture modes (active window and all windows (composite).

• Another attempt to fix random crashes when using screen proctoring.

New Settings

lockdownModePolicy — Integer, default 0 (lockdownModePolicyAutomatic)
Settings window: Security

Controls which kiosk/lockdown mode SEB uses on macOS.

• 0 lockdownModePolicyAutomatic — SEB automatically selects the lockdown mode based on the running macOS version and current settings. Automatic Assessment Configuration (AAC) is used when the macOS version supports it (≥ 10.15.4 except 10.15.5, ≥ 11 with DNS pre-pinning, ≥ 12.0 with DNS pre-pinning, ≥ 12.1 unconditionally) AND none of the following are enabled: screen capture, window capture, screen sharing, browser screen capture, or screen proctoring. Falls back to Classic kiosk mode otherwise.
• 1 lockdownModePolicyEnforceClassic — Always uses Classic kiosk mode (elevated window levels, no AAC), regardless of macOS version or other settings. Dictionary lookup is only available in this mode. The Settings window's Applications pane shows allowSwitchToApplications instead of allowOpenAndSavePanel.
• 2 lockdownModePolicyEnforceAAC — Always enforces Automatic Assessment Configuration (AAC). If the running macOS version does not support AAC, SEB logs an error and AAC is disabled at runtime. The Settings window's Applications pane shows allowOpenAndSavePanel and allowShareSheet instead of allowSwitchToApplications.

Migration: Configuration files that lack this key but have enableMacOSAAC=YES are automatically migrated to lockdownModePolicyEnforceAAC when their minimum macOS version requirement implies AAC support. If they don't have an according minimum macOS version requirement set, then they will get lockdownModePolicyAutomatic and therefore also use AAC on systems which meet the minimum supported macOS version (and don't have any of the screen/window capturing settings enabled, see above).

screenProctoringAACCapturePolicy — Integer, default 2 (screenProctoringAACCapturePolicyAllWindows)
Settings window: Security → "Screen proctoring capture under AAC"

Controls how the optional Screen Proctoring feature captures the screen while the AAC Assessment Mode is active. Under AAC the system screen-capture API returns black output, so SEB renders its own windows via a view-based capture instead; this setting selects what is captured.

• 0 screenProctoringAACCapturePolicyNone — No view-based capture under AAC. In the automatic lockdown mode this also prevents AAC from being selected while screen proctoring is enabled (SEB falls back to Classic kiosk mode, where system capture works). If AAC is force-enabled anyway, capture falls back to the active window.
• 1 screenProctoringAACCapturePolicyActiveWindow — Captures only the active browser window (including its window chrome).
• 2 screenProctoringAACCapturePolicyAllWindows — Captures all SEB windows (browser windows, Dock, alerts) composited onto a full virtual-screen image. Content not in the view's backing store (e.g. hardware-accelerated or protected video) may appear black.

detectAccessibilityApps — Boolean, default true
Settings window: Security → "Detect apps with Accessibility Permissions"

When enabled, SEB detects apps that have been granted macOS Accessibility permissions (which could be misused to remotely control the Mac or automate other apps) and, unless explicitly permitted (see allowAccessibility), adds them to the prohibited applications list and terminates them before and during the session. Requires Full Disk Access; if it is missing, SEB prompts to enable it in System Settings / Privacy & Security / Full Disk Access.

• allowAccessibility — Boolean, default false — property of a permittedProcesses entry
  Settings window: Applications → Permitted (per selected app) → "Allow Accessibility"
  Exempts one permitted application from detectAccessibilityApps, so it may keep its Accessibility permissions without being terminated (and is not terminated at session start even if already running).

hideWiFiControls — Boolean, default false (macOS only)
Settings window: User Interface → Dock

SEB automatically shows a Wi-Fi control (widget) in the SEB Dock when using the AAC Assessment Mode and the macOS menu bar is hidden by settings, so users can view the current Wi-Fi network and switch networks without access to the menu bar. Set this to true to hide that Wi-Fi control even in those situations.