Orb Security Report

What we checked in the Orb build that orb.surf serves today, what we found, and the commands you can run on your own Mac to check the same things.

Build checked

Orb 0.1.0, build 20261103.0434

Engine

Chromium 156.0.8078.80

Checked

November 3, 2026

Published by

Dennis Yilmaz, an individual developer, Apple Team ID 7VA9646HSG

Security contact

orb@denni.sh

Summary

• PassedThe download is signed by the publisher and notarized by Apple. Apple's notary service scans every submission for malware.
• PassedEvery program inside the app is signed by the same developer. The app asks macOS for the same permissions as Google's Chromium, and no more.
• PassedNothing installs itself to run in the background or at login. The app has no privileged helpers, kernel extensions or system extensions.
• PassedOn its own, Orb connects only to Orb's server. Websites you visit are the only other connections.
• PassedWeb pages run in Chromium's macOS sandbox, and Orb never turns off certificate or web security checks.
• PassedThe app contains no API keys, private keys or developer test hooks.
• PassedUpdates are signed, and the app installs only updates signed with the key it ships with.
• PassedChromium is on Google's latest security release for its channel, and none of the other components has a known vulnerability.
• PassedNo antivirus engine on VirusTotal flags either download: 0 of 59 for the disk image, 0 of 65 for the update.
• Not yetAn independent security audit. See the last section.

Check your download

The disk image at orb.surf/download has this SHA-256 checksum:

shasum -a 256 ~/Downloads/Orb-arm64.dmg

2d1a470acb5b456a2ec601a620a91a6a40bdb55444b696cc3ea5ee676dbd1e02  …/Orb-arm64.dmg

Once Orb is in Applications, macOS can confirm who signed it and that Apple notarized it:

spctl -a -vv /Applications/Orb.app

/Applications/Orb.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Dennis Yilmaz (7VA9646HSG)

codesign --verify --deep --strict --verbose=2 /Applications/Orb.app

/Applications/Orb.app: valid on disk
/Applications/Orb.app: satisfies its Designated Requirement

codesign -dvvv /Applications/Orb.app 2>&1 | grep CDHash

CDHash=23152bc8c8f982d404d3b76ca6ed7cc7e7638cf5

The app inside the disk image and the app delivered by automatic update are the same build, with the same code signature hash.

What's inside the app

• 21 signed programs and libraries, all signed with Team ID 7VA9646HSG. Every program runs with Apple's hardened runtime. None allows a debugger to attach, loads unsigned libraries or accepts injected ones.
• The same macOS permissions as Chromium, entitlement for entitlement: camera, microphone, location, Bluetooth, USB, printing and Photos. Each is used only when a website asks and you allow it, and macOS asks you first. Only the page and graphics helpers may compile JavaScript, as in Chrome.
• Nothing that runs on its own. The app has no launch agents, login items, background daemons, privileged helpers, kernel or system extensions, or setuid files. Quitting Orb stops all of it.
• One shell script, Chromium's standard install.sh. It copies the app from the disk image into Applications when you choose to, and it's covered by the app's signature.
• No developer test hooks. Orb's test-only switches are compiled out of release builds. A text scan of the shipped program finds none of them, and passing one to the release build does nothing.

What it connects to

We launched the release build with a fresh profile and recorded every connection it made, both through a recording proxy and at the operating-system level.

Orb's own server carries app updates, certificate revocation and block-list updates, Safe Browsing lookups and Google's Widevine video module. Safe Browsing goes through Orb's relay, so Google doesn't see your IP address. Crash reports and daily usage totals also go there. Both are on by default, Orb shows you their switch before either starts, and you can turn them off in Settings. The privacy policy lists every item and how long it's kept.

The recording proxy logs hosts and ports, not the contents of encrypted traffic. To watch Orb's connections yourself, use a network monitor such as LuLu or Little Snitch.

Keys, tokens and secrets

We scanned about a million text strings from every program in the app for the patterns of Google, GitHub, AWS, Stripe and Slack keys, and for private keys. None were found. The project's full history, 1,150 commits, was also scanned with gitleaks. Every hit was a false positive, such as made-up passwords in tests and file checksums. Orb's Safe Browsing key exists only on the server.

Updates

Orb updates through Sparkle 2.10.0 over HTTPS. Each update is signed with an EdDSA key, and the app installs only updates signed with the public key it ships with. We checked the signature on the update that's live now against that key, and it verifies.

Orb takes Chromium's security fixes every week, and Critical or High fixes the day Google ships them. Orb's publishing tool refuses a release that's missing Critical or High fixes from Google.

Components

The third-party notices list every component and its licence.

Orb's servers

• orb.surf accepts TLS 1.2 and 1.3 only and sends a strict content security policy.
• services.orb.surf accepts TLS 1.3 only.
• Both use HSTS and redirect plain HTTP to HTTPS.

Antivirus scan

Both downloads went to VirusTotal on November 3, 2026. Each link shows every engine's verdict for that exact file.

Engines that can't open the file type aren't counted: 14 for the disk image and 9 for the update. Two more timed out on the disk image.

VirusTotal's Mac sandbox also opened the disk image and ran the app. It raised no detections and matched no detection rules. It added two low-severity behaviour tags, process injection and reflective code loading. Chromium's JavaScript engine compiles code and runs it from memory, which is what the second tag describes. The sandbox runs on the update were still going when this report was written.

Not yet done

• No independent audit. Orb's publisher ran these checks, and no outside firm has reviewed Orb's code. Orb's source code isn't public, so you can't review it yourself either.

No browser is free of bugs, and Orb isn't either. If you find a security problem, write to orb@denni.sh. The security page explains how reports are handled.