KiFinder started as a tool for one job on my own Mac, and lately I have been doing the unglamorous work of turning it into something another person could install. That means the App Store, and the App Store means the App Sandbox. A sandboxed app cannot just read ~/Pictures, so the whole file story had to change. KiFinder now asks for exactly what it needs and nothing more: read-write access to the folders, zips, and files you point it at, the network only to fetch the face model, and the Photos library only when you export. Its library lives in the app's own container by default, and if you pick a custom folder it is remembered as a security-scoped bookmark rather than a bare path the sandbox would lose on the next launch.
The rest was the paperwork of shipping. An App Store category, a declaration that the app uses no non-exempt encryption (it only speaks HTTPS), signing set up so a debug build and a distribution archive each pick the right identity, and a pass to make sure none of my test hooks leak into a release build. That last one mattered more than it sounds. The app honored a set of KION_* launch variables for UI testing, and one of them could bypass the check that the downloaded model is the real one. A release build now strips all of them, so a shipped app sees only its own trusted defaults.
Two smaller things came with getting serious. The enrollment copy assumed you were adding a child ("baby, toddler, and recent shots so they're recognized as they grow"), which is how I use it but not what the app is, so it now reads age-neutrally, because KiFinder finds anyone. And I finished the Japanese localization, all 48 strings, then had Codex review the translations through Sparra. It caught that my "描いた顔" read as an illustrated face rather than a manually drawn region, among other fixes. None of this is the fun part of building an app. It is the part that decides whether anyone else ever gets to use it.