# PDFluent network evidence

Produced 2026-08-19 15:22 UTC by `evidence/verify/run-test.sh`.

## What was tested

The signed, notarised build from the release DMG — not a development
build — opened a PDF while every socket owned by its process was
recorded.

- Document edited and saved: **yes** (the file on disk changed)
- Files written during the run: **1**
    /Users/jasperdewinter/Downloads/test.docx

    started : 2026-08-19T15:18:52Z (UTC)
    duration: 900s
    pids    : 80085
    method  : lsof -nP -i, polled every 0.5s, sockets owned by those pids

## Every connection observed

| First seen | Address | Port | Resolves to |
|---|---|---|---|
| 15:18:57 | `2606:4700:3034::ac43:b5cb` | 443 | pdfluent.com |

Every connection went to pdfluent.com. That is the update check described on /verify. No other destination appeared, and the document itself was never sent anywhere — the PDF engine has no HTTP client to send it with (see CLAIMS.md B09).

## What this does not show

This is an lsof poll, not a packet capture, so it shows destinations and
not payloads. It cannot prove what travelled inside the one connection it
found. Run the same test with Little Snitch or `sudo tcpdump` — /verify has
the command — if you want to see the bytes.

It also cannot show that the binary was built from the source PDFluent
describes. Nothing observable from outside can.