For IT and security
Looking Glass: security in one page
Version 0.1.0 for macOS. Every statement here was checked against the product's source or measured on the signed build. The full security pack comes with the beta invitation.
What it does
- Finds an SAP transaction from plain words or a code and a number
- Opens it in the person's own browser, with the number filled in, using SAP's documented skip-first-screen call
- Asks before anything that can change data; Production can be blocked
What it does not do
- Never connects to your SAP system
- Never reads or writes SAP data
- Never saves, posts, submits or types a password
- No accounts, telemetry, crash upload or auto-update
Network
- The app makes no network requests of its own, measured with Chromium's network log and the operating system
- It hands one https address to the default browser; SAP sign-in and roles decide everything
- Your firewall needs no allowance for the app
Where data lives
- One folder on the person's computer
- Settings, favorites, flows, recent commands and search words, each erasable from Settings
- Nothing is sent to us
How it is built
- Signed with a Developer ID, hardened runtime, notarized by Apple
- Sandboxed, context-isolated window with a strict content policy and a fixed list of calls to the main process
- No runtime dependencies of its own; a software bill of materials is in the security pack
- Electron fuses set: run-as-node, node options and the debugger flag are off, and code loads only from the signed, integrity-checked archive
- Tests fail the build if network code, a dependency, a shell or a looser window is added
What your SAP administrator controls
- Whether skip-first-screen is permitted (
dynp/checkskip1screen, tableTSTCS) - Which roles and systems a person can reach
- If you prefer not to allow it, Looking Glass copies the number for the person to paste
What we do not have
No SOC 2 report, no ISO 27001 certificate, and no third-party penetration test. We offer the evidence above and will fill in your security questionnaire, including the gaps.
Reporting a problem
Email contact@appvantix.com with the subject "Looking Glass security". Please do not include real SAP data or credentials. See also security.txt.