Santa release notes

Security

The Santa codebase has been undergoing dedicated security review by folks with access to frontier AI security models. The issues fixed below were identified through that work, and we recommend updating. This is an ongoing investment to ensure Santa remains your most trusted endpoint security solution.

• 🔒 Fixed two issues related to Mach-O parsing that could prevent policy from being effectively enforced on specially crafted x86 binaries
• 🔒 Fixed a heap buffer overflow that could be triggered with certain EventLogType configurations when an execution contained an extremely large number of arguments
• 🔒 Improved tamper resistance handling to protect against local rule modification
• 🔒 Fixed a narrow issue with File Access rules where an exception applying to platform binaries only could be erroneously granted to unsigned x86 binaries
• 🔒 Fixed a narrow issue affecting CEL policies that conditionally returned ALLOWLIST_COMPILER after accessing a non-cacheable field

Full details for each issue are available in the published advisories.

Announcements

• 🎉 Get the most out of Santa with Workshop! Workshop is North Pole Security’s official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at northpole.security.

Fixed

• ❗ Dock icons no longer stick around when quickly closing stacked UI windows
• ❗ Fixed issue with file types being unexpectedly handled by Santa
• ❗ Workshop customers: CEL process ancestor data reliability greatly improved under load

Changed

• ↔️ Improved tamper resistance features protecting critical Santa components
• ↔️ Several small performance and memory improvements
• ↔️ Workshop customers: Users now receive a notification banner when temporary admin mode session ends (EPM)

Added

• ➕ The block dialog “open” button label can now be configured per-rule
• ➕ Workshop customers: Santa now supports queued commands that are delivered on the next sync, so commands issued while a host is offline still run
• ➕ Workshop customers: Signal matches on telemetry now include process tree and responsible process info in uploaded events
• ➕ Workshop customers: Signals can now be correlated across a time period, requiring a threshold before firing
• ➕ Workshop customers: Added new package inventory command to support scanning hosts for data about Homebrew, PyPI, Go, NPM, browser extensions, IDE extensions, and much more

Announcements

• 🎉 Get the most out of Santa with Workshop! Workshop is North Pole Security’s official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at northpole.security.

Fixed

• ❗ Fixed regression with compiler rules that could prevent Santa from generating transitive rules

Changed

• ↔️ When using protobuf, protobuf variants, and JSON EventLogType values, when a spool is filled, the oldest files are now evicted instead of dropping the newest events.
• ↔️ Workshop customers: Network activity telemetry now includes hostname, and rule match information

Added

• ➕ Support for new rule policies SILENT_GUI_BLOCKLIST and SILENT_TTY_BLOCKLIST to allow more fine-grained silencing options over the existing SILENT_BLOCKLIST
• ➕ santactl doctor now checks certificate validity
• ➕ protobuf telemetry now contains an opaque unique identifier event_id per-message
• ➕ Workshop customers: On device telemetry scanning, EDR signals
• ➕ Workshop customers: Network rule support to enable blocking/allowing network activity
• ➕ Workshop customers: Endpoint Privilege Management (EPM) support to further lock down endpoints by limiting access to admin and sudo privileges
• ➕ Workshop customers: CEL policies now have access to today() and days(X) functions to support relative time checks
• ➕ Workshop customers: New sandbox policy placeholder variable support: BINARY_PATH

Announcements

• 🎉 Get the most out of Santa with Workshop! Workshop is North Pole Security’s official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at northpole.security.
• 📣 If you’re using telemetry with Workshop, please upgrade to Workshop v2026.5 before rolling out Santa v2026.5 to ensure no gaps in collected data.

Fixed

• ❗ Fixed a rare issue with sync service rate limiting
• ❗ Fixed reachability handling so Santa reliably resumes syncing after the network comes back
• ❗ Workshop customers: The network extension’s DNS proxy now rides out transient network changes (e.g. VPN reconnects) instead of dropping queries
• ❗ Workshop customers: Improved push notification connection reliability

Changed

• ↔️ Uploaded events for platform binaries will now be classified with the decision ALLOW_PLATFORM instead of ALLOW_CERTIFICATE
• ↔️ The santactl eventupload command has been renamed to santactl inventory (eventupload still works as an alias)

Added

• ➕ Workshop customers: New rule policy that confines a binary to a specified sandbox profile (BETA)
• ➕ Workshop customers: Trigger an on-demand binary upload from an endpoint with a real-time push notification (BETA)
• ➕ Workshop customers: CEL fallback rules can now be used with platform binaries
• ➕ Workshop customers: CEL policies can now return AUDIT to generate an event without blocking the operation
• ➕ New July 20 easter egg in the Santa UI for anyone with the FunFontsOnSpecificDays config key set

Announcements

• 🎉 Get the most out of Santa with Workshop! Workshop is North Pole Security’s official sync service, built to integrate deeply with Santa. It is fully featured, scalable, and enterprise ready. Learn more at northpole.security.

Fixed

• ❗ EventDetailURL template parameters are now properly percent-encoded
• ❗ Improved File Access event logging when source data had been lost due to cache evictions

Changed

• ↔️ Clean syncs now also replace all settings managed by the sync server in addition to rules. Sync server operators must send all desired settings during the Preflight phase of a clean sync.
• ↔️ SyncBaseURL is now required to be HTTPS unless configured to use localhost
• ↔️ The sync service no longer retries requests on non-transient errors (e.g. most HTTP 4xx errors)
• ↔️ Keyboard shortcuts now conform to idiomatic system shortcuts. Cmd+W closes windows, Esc closes panes such as the “More Info” pane.

Added

• ➕ Blocked device mount notifications can now be silenced
• ➕ Strengthened anti-tamper protections across additional filesystem operations, signal handling, Endpoint Security data validation, and Santa’s own upgrade path.

The lite package has moved so automation consuming the previous URL will need updating.

Announcements

• 🎉 Get the most out of Santa with Workshop! Workshop is North Pole Security’s official sync service, designed to deeply integrate with Santa. It is fully featured, scalable, and enterprise ready. Learn more at northpole.security.
• 📣 There is now a “Santa Lite” package included in the release. It is generally not recommended to use this but we recognize there are users that want reduced packaging. Read the Lite Package docs for more information.
• 🔒 Security Advisory: For security reasons, we strongly recommend all users update to Santa 2025.12 or newer. On prior versions, an attacker with admin privileges could bypass Santa. A detailed blog post will be published soon with more information.

Fixed

• ❗ Fixed issue where sync interval settings were not always being correctly applied
• ❗ Workshop customers: Improved handling of network mount name formats

Changed

• ↔️ Sync interval settings sent by the sync server are now persisted and will be used as the default on restarts
• ↔️ Workshop customers: Telemetry filter expressions from the MDM config now take precedence over filter expressions configured in Workshop

Added

• ➕ Santa can now enforce encryption settings when blocking/remounting removable media (currently APFS only)
• ➕ Several performance and memory improvements to keep Santa snappy
• ➕ Santa can be configured with a set of signing IDs to extend pid_suspend protections to other software
• ➕ santactl fileinfo now has an “expected decision” field that shows if Santa is expected to allow or deny the execution (note: runtime characteristics may still result in a different decision being applied)
• ➕ CEL policies now have access to path and is_platform_binary properties
• ➕ santactl doctor now validates FAA configurations
• ➕ Block reason has been added to the UI/TTY
• ➕ Added pid_suspend/pid_resume to telemetry
• ➕ Workshop customers: CEL fallback policies - You can now add CEL expressions that can apply a global policy in the event no specific rule matched
• ➕ Workshop customers: CEL policies can now access ancestor execution arguments
• ➕ Workshop customers: CEL policies can now basic access file descriptor information, enabling policies to express how to handle conditions like stdin attached to a pipe or socket
• ➕ Workshop customers: Added real-time command to trigger hosts to upload installed binaries/bundles
• ➕ Workshop customers: MDM policies can now define the set of allowed real-time commands
• ➕ Workshop customers: Santa will now upload metrics directly to Workshop by default, allowing performance monitoring

Announcements

• 🎉 Santa has a new Workshop! North Pole Security is excited to announce the release of Workshop, an official sync service specifically designed to deeply integrate with Santa. It is fully featured, scalable, and enterprise ready. Come learn more at northpole.security.
• 📣 The Santa package now includes two new binaries: a network extension daemon (com.northpolesec.santa.netd) and a helper utility for telemetry export (sleigh). Both are intended for use by Workshop customers only.

Fixed

• ❗ Fixed issue where the Santa UI could appear to open smaller than needed and then “snap” to the correct size
• ❗ Fixed a rare UI state race condition that could inadvertently cause the About dialog to be displayed when it shouldn’t
• ❗ Terminal prompts are no longer hidden when an application executed from a terminal is blocked and Santa writes information to the TTY
• ❗ Fixed regression where custom URLs or EventDetailURL values of “null” were not appropriately removing the button from the UI

Changed

• ↔️ Santa now properly registers for notifications on startup. Unless the system has a Notifications profile installed, users may see a system banner notifying them that Santa would like to send notifications. No new or additional notifications exist.
• ↔️ Compiler rules now also track file clone events for tracking executable output in order to create more comprehensive transitive rules. This is commonly seen with newer rust/cargo toolchains.
• ↔️ santactl doctor feedback around sync availability is now significantly more accurate, with fewer false positives
• ↔️ Terminology around “USB blocking” has been standardized to “removable media blocking” to better reflect the full range of devices Santa handles, such as SD cards, Thunderbolt drives, and NVMe devices

Added

• ➕ CEL policies now have access to the executing binary’s signing ID during evaluation, enabling capabilities such as wildcard matching
• ➕ Added support for the FileAccessEventDetailURL and FileAccessEventDetailText configuration keys, used as fallbacks when there is an FAA block and no per-rule URL or text is provided
• ➕ Execution events sent to the sync server now indicate whether or not the applied rule was a static rule
• ➕ A CEL playground is now available for testing and validating CEL rules
• ➕ Added French (France), French (Canada), and Spanish translations
• ➕ Workshop customers: Removable media block events are now uploaded during sync and viewable in Workshop
• ➕ Workshop customers: Telemetry filtering expressions allow you to redact/filter telemetry before being exported
• ➕ Workshop customers: CEL rules can now act upon the process tree when making a decision
• ➕ Workshop customers: (BETA) Santa can now report network telemetry

Announcements

• 🎉 Santa has a new Workshop! North Pole Security is excited to announce the release of Workshop, an official sync service specifically designed to deeply integrate with Santa. It is fully featured, scalable, and enterprise ready. Come learn more at northpole.security.
• 📣 macOS 13 (Ventura) is no longer supported.

Fixed

• ❗ Instigating process information is no longer missing for File Access rule violations committed by processes that started before Santa was running
• ❗ Fixed issue that prevented blocking mounts of certain external media types
• ❗ Blocked USB mounts are now logged in the telemetry stream
• ❗ Fixed overzealous caching of blocked execution events if the event was unable to be uploaded immediately due to network issues
• ❗ Removed unintentional escape codes in santactl fileinfo --json output

Added

• ➕ Co-branding is now supported, allowing admins to configure their company name or logo to be displayed on Santa UI dialogs
• ➕ Santa now has a menu item! This has functionality to trigger a sync and reset any silenced block notifications. For Workshop customers, you can also control temporary monitor mode and see how much time is remaining. Users can turn this off or on from the “About” dialog. Admins can configure this to be off by default by setting the EnableMenuItem configuration key to false.
• ➕ The santactl fileinfo command now supports a --verify flag to display code signature validation result for each slice of the binary as well as a security assessment via spctl
• ➕ Workshop customers: Network shares can now be blocked from mounting and exception lists can be configured (macOS 15+)
• ➕ Workshop customers: Push command support to terminate arbitrary processes
• ➕ Workshop customers: You can now use CEL rules to require that a user performs TouchID

Announcements

• 🎉 Santa has a new Workshop! North Pole Security is excited to announce the release of Workshop, an official sync service specifically designed to deeply integrate with Santa. It is fully featured, scalable, and enterprise ready. Come learn more at northpole.security.
• 📣 Santa will be ending support for macOS 13 (Ventura) in January 2026.

Fixed

• ❗ Rules received from a sync server with CEL policies using features not supported by the current version of Santa will no longer cause syncing to fail.
• ❗ Addressed a memory leak in the santasyncservice process.
• ❗ Window icons are no longer blurry

Changed

• ↔️ The name for Santa as shown in the macOS settings Privacy & Security Full Disk Access pane is now more descriptive: “Santa Endpoint Security Extension”.
• ↔️ Support for the EnableForkAndExitLogging configuration key has been removed and configurations should migrate to using the Telemetry key.
• ↔️ The target field in FileAccess telemetry messages emitted by FAA rule violations was switched to be a FileInfo type. This is a wire-, forward-, and backward-compatible protobuf change that now allows consumers to see stat(2) info.

Added

• ➕ [Workshop Customers] On-Demand Monitor Mode! Admins can configure policies for hosts that allow users to temporarily enter Monitor Mode as needed for a defined period of time. Hosts will automatically revert to Lockdown Mode once the time expires. This enables a much smoother experience for users like developers that need to constantly build & run new binaries without having machines carry permissions for longer than necessary.
• ➕ CEL policies have access to two new fields which allow for more dynamic and flexible rules: the effective user ID (euid) and current working directory (cwd).
• ➕ EventDetailURL and EventDetailText can now be set by the sync server.
• ➕ santactl rule can now be used to check if a given path is covered by a Data FAA rule.
• ➕ santactl status now displays the current sync interval.
• ➕ More comprehensive anti-tamper protections.

Announcements

• 🎉 Santa has a new Workshop! North Pole Security is excited to announce the release of Workshop, an official sync service specifically designed to deeply integrate with Santa. It is fully featured, scalable, and enterprise ready. Come learn more at northpole.security.
• 📣 Ready for Tahoe. This version has been validated on macOS Tahoe 26.0.
• 📣 Santa will be ending support for macOS Ventura in January 2026.

Fixed

• ❗ Changes to push notification sync intervals now take effect immediately instead of waiting until the next cycle.

Changed

• ↔️ The sync service is restarted when push notifications are enabled/disabled so the new configuration can take effect.
• ↔️ If Santa is unable to communicate with the sync server when push notifications are enabled, it will reschedule the next attempt for the smaller of either 10 minutes or the current push notification full sync interval.
• ↔️ Sync intervals are now scheduled with a 5 second leeway (previously, there was an allowed variance of up to 50% of the sync interval time). This will make sync intervals more consistent.