Compliance

Spotlight & Quick Look PHI boundary

The packaged macOS app never indexes DICOM tag values into the system-wide Spotlight index or a Quick Look cache.

Problem

dcmage lite packages the application as a native macOS .app. macOS lets any bundle register a CoreSpotlight importer, a Uniform Type Identifier metadata importer (mdimporter), or a Quick Look content extension (qlgenerator) that reads a file’s content and writes derived metadata into a system-wide index or thumbnail cache. If dcmage ever registered one of these for .dcm files, Patient Name, MRN, and Date of Birth would end up in the macOS Spotlight index and a Quick Look thumbnail cache — outside the application’s own process boundary, surfaced by unrelated tools (Spotlight search, iCloud/Time Machine backups, third-party indexers), and surviving even after the app itself is deleted.

Boundary

dcmage lite does not register any of these system-level content extensions. The packaged bundle and build configuration are the enforcement surface:

No CoreSpotlight importer, mdimporter, or qlgenerator target is declared in src-tauri/Cargo.toml, tauri.conf.json, tauri.lite.conf.json, the hardened-runtime or App Store entitlements, or package.json.
Fast in-app search (⌘/Ctrl+K) stays isolated to the application’s own local history — it never touches Spotlight.
A native Quick Look thumbnail generator for .dcm files is out of scope for this release; it is deferred (backlog #40) and, if built, must render pixel data without burning in demographic overlays unless anonymize mode is active.

DICOM files accepted through the in-app feedback channel are a separate, already-implemented control: they are routed through the attachments/dicom/ storage prefix and swept after 7 days (rather than the standard 90-day retention), independent of this boundary.

Result

The absence of a system-level content-indexing extension is itself the safety property. It is verified by scanning the packaged bundle and build configuration for Spotlight/mdimporter/qlgenerator markers and asserting none are present — a regression in this boundary (someone adding such a plugin or target later) fails the check immediately rather than silently shipping.