Back to Script Studio Pro guides

Script Studio Pro guide

Security and Privacy

Script Studio Pro is coming soon. This is preview documentation; details may change before release.

Script Studio Pro is designed for sensitive administrative workflows. Treat connected services, scripts, exported files, and API credentials with the same care as other enterprise administration tools.

Credentials

Script Studio Pro connects to a management server using OAuth client credentials.

When credentials are stored, they are stored in the macOS Keychain. Saved services and stored credentials can be managed from Settings.

Do not share client secrets in screenshots, support tickets, logs, documentation examples, or exported files.

API Access

Use least-privilege API roles. Grant only the privileges required for the workflows your organisation allows in Script Studio Pro.

For read-only evaluation, use a client that can read scripts, policies, categories, and computer inventory but cannot create, update, or delete objects.

For production editing, use a client that is approved to update scripts and manage the specific policy or deployment objects required by your team.

Script Content

Scripts can contain sensitive operational logic, internal URLs, credentials, package paths, API calls, and security tooling references.

Before exporting or sharing scripts:

  • Remove secrets and customer data.
  • Confirm the destination is approved.
  • Treat exports as sensitive files.
  • Store exports in a protected location.

Local Execution

Current User execution runs locally as the signed-in macOS user inside the app sandbox.

Management-style workflows should be tested through Enterprise Simulation or through a controlled test policy before production deployment.

Deletion and Policy Impact

Deleting scripts can break policies that reference those scripts. Review linked policy information before deleting scripts, especially in bulk.

Logs

The app includes operational logging for connection, script, policy, deployment, export, runner, and Keychain-related status. Avoid sending logs externally without checking for sensitive details.

External References