Notes
Security
The Santa codebase has been undergoing dedicated security review by folks with access to frontier AI security models. The issues fixed below were identified through that work, and we recommend updating. This is an ongoing investment to ensure Santa remains your most trusted endpoint security solution.
🔒 Fixed issues where a local user could race Santa's inspection of an executable so that policy was evaluated against different content than the kernel was about to run
🔒 Fixed issues where a cached execution decision could be reused after the underlying content changed
🔒 Fixed an issue where a universal binary declaring an unusually large number of architectures was treated as a non-Mach-O file and allowed to run
Full details for each issue are available in the published advisories.
Announcements
🎉 Get the most out of Santa with Workshop! Workshop is North Pole Security's official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at northpole.security.
📣 Ready for Golden Gate: this release has been validated on macOS Golden Gate (27.0).
Fixed
❗ Interrupted HTTP responses no longer result in a successful sync. A clean sync with an interrupted response would apply a partial rule set on the host.
❗ Transitive rules now evaluate at the lowest precedence level so that they cannot interfere with other established rules on the host
❗ Fixed a rare UI beachball when displaying block dialogs
❗ Changes to transitive rule settings now take effect immediately instead of leaving stale cached decisions
Changed
↔️ Santa no longer presents a block dialog when it is determined that the OS will not allow the execution to continue anyway
↔️ Santa package receipts now include the full version (i.e. Year.Release.Build)
↔️ Sync settings and state applied from a given SyncBaseURL are now cleared when the SyncBaseURL changes (note: this can take about 10 minutes to take effect)
↔️ Improved tamper protections
↔️ Several performance improvements, including exec path evaluation and UI rendering
↔️ EnablePageZeroProtection now only applies to 32-bit (i386) images, matching the kernel, which enforces __PAGEZERO itself for every other image type
↔️ Workshop customers: Execution telemetry now reports whether a decision was made while in Temporary Monitor Mode
Added
➕ zsh autocompletions for santactl
➕ Workshop customers: Santa now supports timed rules. CEL policies can use policy_for_range() to define time windows for when a binary is allowed to run, and kill_on_expiry() to forcefully quit the process when the window expires. Users are shown a notification ahead of the quit with the process and rule details.
➕ Workshop customers: Per-process options for file access rules, allowing fine-tuned policy for processes that should be silently denied, audited only, given custom messages/URLs, and more
The Santa Lite package is rarely the right choice. Install the standard package unless you have a specific reason not to. Workshop customers should not install lite since it omits many features. See the lite package documentation for details. Download at: santa-2026.8-lite.pkg.
Santa documentation can be found at northpole.dev.
What's Changed
- Release 2026.7 by @mlw in #1113
- fix lint by @tburgin in #1114
- workflows: Reduce scheduled macOS runner minutes by @mlw in #1110
- Remove the Foundation dependency from ScopedTypeRef.h by @mlw in #1117
- pkg: Include build version in package by @russellhancox in #1120
- docs: Update brace-expansion and fast-uri deps by @russellhancox in #1118
- gui: Move all XPC processing away from main thread by @russellhancox in #1116
- santactl/rule: Unify rule change result reporting by @mlw in #1112
- santad: Tamper-protect Sleigh DB path with carve-out for Sleigh by @russellhancox in #1119
- ci: Run continuous job on self-hosted runner by @russellhancox in #1122
- logging: Log under a com.northpolesec.santa subsystem by @mlw in #1121
- build: Move to C++23 by @mlw in #1124
- build: Bump module dependencies by @mlw in #1127
- pkg: Fail notarization on a non-Accepted status by @mlw in #1129
- build: Hold rules_apple at 4.3.3 by @mlw in #1130
- pkg: Verify every architecture slice before notarizing by @mlw in #1131
- pkg: Require both architectures in every signed artifact by @mlw in #1132
- pkg: Sign and notarize the netd system extension by @mlw in #1133
- docs: Update deps to fix dependabot alerts by @russellhancox in #1134
- santactl: Make the duration parser generic by @mlw in #1125
- sync: fix truncated clean sync by @tburgin in #1137
- santad: Reuse completed codesign validation across non-cacheable decisions by @mlw in #1139
- santad: Don't present UI during signature invalidation by @russellhancox in #1138
- santactl: Add generated zsh autocompletion by @russellhancox in #1135
- MOLCodesignChecker: Fix the initWithSecStaticCodeRef: initializers by @mlw in #1140
- Remove the verifying hasher by @mlw in #1141
- BUILD: Fix build of zsh_completion by @russellhancox in #1142
- docs: Document workshop pinning by @russellhancox in #1143
- Rank transitive rules below every configured rule type by @mlw in #1144
- santad: Group FAA rule options into a struct by @russellhancox in #1148
- santad: Add signal and process group options to KillingMachine by @sharvilshah in #1149
- docs: make default profiles downloadable by @russellhancox in #1158
- santad/gui: add sigterm-then-sigkill to KillingMachine and a pre-quit UI notification by @sharvilshah in #1152
- celv2: add CEL functions policy_for_range(), now(), weekdays() by @sharvilshah in #1147
- santad: Parse ProcessesWithOptions FAA rules by @russellhancox in #1150
- santad: negative cache for execution rule lookups by @tburgin in #1162
- santad: fix group kill reporting and harden kill request signal decode by @mlw in #1165
- santad: stop SNTRuleTableTest inheriting the machine's static rules by @mlw in #1166
- common: Speed up SNTFileInfo bundle lookup by @mlw in #1164
- santad: Evaluate ProcessesWithOptions FAA rules by @russellhancox in #1160
- gui: Fix beachball rendering block messages, throttle bundleservice updates and drop main-queue drops by @russellhancox in #1167
- santad: Remove noisy debug line when watched paths are unchanged by @russellhancox in #1169
- santad: add SNTTimedRuleKills which the kill-at-window-end component by @sharvilshah in #1153
- santad: timed rule kills re-check the window at fire time by @sharvilshah in #1159
- santad: record and enforce timed rule kills from policy evaluation by @sharvilshah in #1161
- santad: don't cache execution rule misses for file-hash-only lookups by @tburgin in #1163
- Clear synced state when SyncBaseURL is removed or changed by @mlw in #1151
- docs: Add custom branding page with examples of branding by @russellhancox in #1170
- config: Normalize sync-configured regexes, reject empty pattern by @russellhancox in #1168
- santactl/status: Report sync-server provided telemetry filters by @russellhancox in #1172
- cel: replace policy_for_range()'s
should_killarg withkill_on_expiry()wrapper by @sharvilshah in #1174 - gui: show full process and rule details in the timed rule kill dialog by @sharvilshah in #1171
- santad: quit timed rule kills by recorded execution, supporting every rule type by @sharvilshah in #1175
- santad: timed rule kills quit only the recorded process by @sharvilshah in #1176
- gui: Use full unit style in silences time picker by @russellhancox in #1178
- docs: Update npm dependencies by @russellhancox in #1179
- docs: time based rules by @sharvilshah in #1181
- santad: Clear cache when transitive rule state changes by @russellhancox in #1180
- telemetry: Report temporary monitor mode by @russellhancox in #1182
Full Changelog: 2026.7...2026.8