Security

No network, enforced by the kernel

At launch the App calls sandbox_init on its own process with a Seatbelt profile that denies every socket ((deny network*)). Every connect() then returns EPERM. Settings → Privacy runs a connection attempt on demand and shows the result. The one exemption is Apple's /usr/bin/log, which cannot run inside a sandbox and is exec'd by literal path to stream the pasteboard daemon's log into the App's pipe.

Secrets stay hidden

When a copy is classified as a secret, the App rewrites it with the nspasteboard.org Concealed marker so other clipboard managers skip it. The clipboard log keeps only a hash, the kind and the length. Clipboard history keeps the secret inside its encrypted file, shows it masked (ghp_••••), asks for Touch ID or your password before revealing or pasting it, and pastes it back with the Concealed marker again. Search matches a secret's kind, never its content.

Encrypted clipboard history

History is sealed with AES-256-GCM (CryptoKit) into a single file readable only by your user account. The 256-bit key is generated on first use and stored in the login Keychain as a device-only item. If the Keychain refuses access, history stays in memory for that session and the key is never replaced. Items marked transient or auto-generated by the app that wrote them are never kept. Turn off "Keep secrets" in Settings → History and secrets are skipped entirely.

Source included

Every purchase includes the complete Swift source under the ClipAudit Source License. The prebuilt App is built from that source, signed with our Apple Developer ID and notarized by Apple.

Permissions

• None for clipboard history, the clipboard log and secret concealment.
• Accessibility, optional, to paste a history item into the app you are using. Without it, picking an item copies it.
• Input Monitoring, optional, for ⌘C/⌘V attribution.
• Notifications, optional, for conceal alerts.

Activation

Activation happens on this website. The App shows a device code derived from a one-way hash of the hardware identifier; the website sends your key and that code to Polar and returns a license signed with Ed25519, which the App verifies with an embedded public key. The private key lives only in the activation service.

Reporting a vulnerability

Email security@clipaudit.app. We acknowledge within two business days and credit reporters in the changelog if they wish.