Elevation model
Pluto's Tweaker launches unelevated (asInvoker) by default. Browsing, scanning, reports, History, Logs, and Live Log all work without administrator rights. Elevation is requested — via Windows' standard runas mechanism, a full process relaunch — only at the moment you start a mutating action, and only for that action.
This is not currently split into a minimal unelevated UI plus a separately-scoped elevated helper process; both sides are the same executable and the same code. That further split was reviewed and deliberately deferred — a hand-built IPC layer crossing a privilege boundary is exactly the kind of code where a subtle mistake creates a new, potentially more severe vulnerability than the one being reduced, and validating it properly needs adversarial testing on a real machine that hasn't been done here. This is recorded as a reasoned decision, not an oversight.
Typed operations only
The elevated code path has zero ability to run an arbitrary command, path, or argument string. Every mutation is one of seven closed, reviewed operation shapes: registry value, service state, power setting, network adapter DNS, process priority, repair operation, or temp cleanup. Nothing in this application constructs or executes a shell command line built from a string.
| Rule | Enforced by |
|---|---|
| No arbitrary shell execution | Closed 7-type operation dispatch; deny-by-default executable/registry/service/power/network/process-name policies |
| No downloadable scripts or remote tweak code | The tweak catalog ships inside the install package; no network fetch of catalog content anywhere |
| Never disables Defender / Firewall / Windows Update / Secure Boot / VBS | No operation type can target any of these; no "security setting" category exists in the catalog schema |
| No game injection, memory access, or anti-cheat interaction | No code opens a handle to another process's memory or interacts with any anti-cheat component |
| No kernel-mode driver | Verified by an automated dependency scan and the packaging pipeline's content-security gate |
| No Realtime process priority | Refused at catalog-load time and again at execution time, independently |
| Restore/recovery always works, even with an expired license | License-state checks structurally never gate Detect/History/Logs/Export/Restore All |
| No secrets, certificates, or keys committed to source control | Signing certificates and license-signing keys are always supplied externally, never generated into the repository |
| No automatic telemetry without opt-in | No network telemetry call exists anywhere in the application |
No kernel driver
An earlier beta build used a hardware-monitoring library that embedded a legacy kernel driver payload inside its own shipped file, regardless of which sensors were actually enabled. That library was removed entirely, not merely disabled — hardware telemetry today reads only memory usage via a standard, documented, driver-free Windows API. GPU and storage sensors are honestly reported as "Unavailable" rather than guessed at or obtained through a broader-access driver.
Residual risks (stated honestly)
- Full-process elevation, not a minimal helper process. Documented above, accepted for this release, not hidden.
- Registry-write and service-control code runs in the same elevated process as the rest of the UI code, rather than in an isolated helper — mitigated by the closed typed-operation surface, not eliminated by process isolation.
- Elevation uses the standard, Microsoft-documented
ShellExecute/runasmechanism — no custom privilege-escalation logic — but this project has not had an external security audit. - No external penetration test has been performed on this application. This page and the underlying design document are an internal review, not a substitute for one.
See Checksums & SBOM and Third-party notices.