Harden App Store build for review

SECURITY.md

@@ -4,24 +4,21 @@ Audit date: 2026-08-11 · Scope: app, widget, relay, build pipeline, git history
 
 ## Summary
 
-No critical issues. No secrets in source, git history, or binaries. One
-architecture note (relay IP baked into the app) is scheduled for removal by
-the govuk-API switch (BACKLOG P0). Findings below are ordered by severity.
+No critical issues. No secrets in source, git history, or binaries. The prior
+LAN relay/private-IP app path has been removed from the app binary; production
+data access is public HTTPS GitHub mirror plus bundled fallback. Findings below
+are ordered by severity.
 
 ## Findings
 
-### 1. LAN IP baked into app binary — MEDIUM (planned fix)
+### 1. LAN IP baked into app binary — RESOLVED
 
-- `Shared/FuelPriceProvider.swift:52` — `baseURL = URL(string: "http://192.168.1.131:8788")!`
-- Confirmed present in the built app binary (`strings`).
-- **Why it works**: ATS exempts raw numeric IP addresses (documented Apple
-  behaviour), so no `NSAllowsArbitraryLoads` exception exists in the plist —
-  the plist is clean.
-- **Risk**: the relay is a private LAN host; the app is unusable off the
-  user's network, and the URL is effectively a hardcoded endpoint.
-- **Fix**: the govuk API switch (BACKLOG P0) replaces this with the HTTPS
-  gov.uk endpoint via the relay. For any future public build, the app should
-  talk to an HTTPS domain, never a raw IP.
+- The app no longer contains `RelayFuelProvider`, `fuelboard.relayFallback`,
+  `NSLocalNetworkUsageDescription`, or a private `192.168.*` live-data endpoint.
+- Live data uses the public HTTPS GitHub mirror; the app falls back to bundled
+  data/cache when the mirror is unavailable.
+- A built-binary `strings` scan should remain part of every release gate to
+  ensure no private LAN endpoint is reintroduced.
 
 ### 2. No secrets in source / git / binary — PASS
 
@@ -31,8 +28,9 @@ the govuk-API switch (BACKLOG P0). Findings below are ordered by severity.
 - Relay: `CLIENT_ID`/`CLIENT_SECRET` read from environment only
   (`app/main.py:31-32`); `.env` is gitignored; `__pycache__`/`*.pyc`
   untracked; `.env.example` ships empty placeholders.
-- Binary scan: only the relay IP, `maps.apple.com`, and `group.com.apt.fuelboard`
-  strings found. No credentials.
+- Binary scan should show no private LAN data endpoint; expected network strings
+  include public GitHub raw URLs, `maps.apple.com`, and `group.com.apt.fuelboard`.
+  No credentials.
 
 ### 3. Price data hardening — PASS (three layers)
 
@@ -53,11 +51,11 @@ the govuk-API switch (BACKLOG P0). Findings below are ordered by severity.
 - `kSecAttrAccessibleAfterFirstUnlock` — widget can read after reboot without
   unlock. Correct for background widget refresh.
 
-### 5. Transport security — PASS for LAN dev, MUST CHANGE for public
+### 5. Transport security — PASS
 
 - No `NSAllowsArbitraryLoads` anywhere (confirmed by plist + pbxproj grep).
-- Cleartext HTTP only to the LAN relay IP (ATS-exempt). Once the relay moves
-  behind an HTTPS domain (govuk switch), no ATS changes are needed.
+- No cleartext LAN relay endpoint ships in the app binary. Live network data is
+  fetched over HTTPS from the public GitHub mirror.
 
 ### 6. Privacy / permissions — review for App Store