Browsing, testing and extraction are read-only with respect to input archives. Explicit ZIP additions, deletions, renames and explicit single-file replacements use a verified transactional replacement; see ZIP addition boundaries and ZIP edit boundaries. Extraction creates a private 0700 staging directory inside the selected destination and only publishes successful output into a new uniquely named directory. Existing files are never replaced. Output keeps safe read/execute permission bits and guarantees owner read/write access (and directory traversal); setuid/setgid and group/other write bits are stripped. Ownership, xattrs, ACLs, resource forks and timestamps are not restored. The packaged Arkiv app is tested after extraction, including executable permissions and signatures.

Every backend-supplied path is checked for absolute paths, dot/dot-dot components, empty components, control characters, backslashes, colons and a 4096-byte length limit. ZIP backslashes may already have been normalized by libarchive; traversal after normalization is still rejected. UTF-8 conversion must succeed. Symlinks are preserved as objects, including absolute and parent-relative targets. Arkiv never follows those links when writing subsequent entries. Hard links can reference only regular files created by this extraction, including forward references; external, missing, cyclic or unselected targets fail clearly. Unsupported special entries (FIFO/device/socket) are skipped with per-entry warnings. Each path component is opened relative to an owned directory descriptor with O_NOFOLLOW; files use O_EXCL. No string-prefix confinement checks or archive_write_disk are used. On case-insensitive volumes, colliding regular files fail instead of replacing data.

Budgets cap entry count at 100,000 and streamed expanded output at 20 GiB. Limits are checked against metadata and actual data. No whole archive is loaded into memory. The 7z bridge applies a decoder memory budget and AES KDF exponent cap, documented with the backend. There is not a universal hard CPU-time or compression-ratio budget: hostile archives remain a risk. Cancellation is checked before headers and between 64-KiB reads, but cannot interrupt a blocking libarchive header/skip call. Treat this as development software; hostile-input fuzzing and an isolated decoder helper are future hardening tasks.

Source identity/size/mtime plus catalog are rechecked before extraction and source metadata afterward. This catches ordinary changes, but is not a cryptographic immutable-input guarantee against an actor who can rewrite a file and restore metadata concurrently. A future backend should pin a file descriptor and define concurrent-mutation handling. Nothing should claim protection from another process running with the same user's privileges.

Failure/cancellation cleanup is best effort; a process crash or filesystem cleanup failure may leave a hidden .arkiv-UUID directory in the selected destination. Do not recursively remove arbitrary matches at startup. A future crash-recovery journal must establish ownership before removing stale data. Open-file copies use a separate owned workspace lifecycle; see Open-file lifecycle.

Passwords are not saved, logged or sent through URLs/arguments. 7z AES unlock uses a private temporary plaintext TAR spool retained for the open snapshot and deleted on normal cleanup; a crash can leave that data behind. This is not secure erasure. See 7z security boundaries. ZIP encryption remains unsupported. Error messages intentionally avoid echoing untrusted backend strings into logs. Hardened Runtime is applied to local app bundles; they are ad-hoc signed and unnotarized. This is not yet an App Sandbox build.

Finder Services reuse the same engine and private staging. Extract Here preflights conflicts and publishes with atomic no-replace renames, never merging existing directories. Multi-item publication is not transactional: races/errors/cancellation can leave already-published items plus a recovery folder. No overwrite or destructive rollback is permitted. See Finder publication guarantees and limits.

See link-aware extraction for compatibility and validation details.