# Apple Notes Security Basics

> Apply security best practices for Apple Notes automation scripts. Trigger: "apple notes security".

- Skill: `jeremylongshore/apple-notes-security-basics` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jeremylongshore/apple-notes-security-basics`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jeremylongshore/apple-notes-security-basics/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: jeremylongshore (https://skillmd.com/u/jeremylongshore)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/jeremylongshore/apple-notes-security-basics

---


# Apple Notes Security Basics

## Security Checklist
- [ ] Scripts run only locally (never expose osascript to network)
- [ ] No note content logged to files (may contain sensitive data)
- [ ] TCC permissions scoped to specific apps only
- [ ] Exported notes stored with appropriate file permissions
- [ ] iCloud account uses 2FA
- [ ] Automation scripts do not hardcode note content

## AppleScript Sandbox Restrictions
```bash
# Apple Notes runs inside the macOS sandbox
# Scripts can only access Notes via Apple Events (not direct file access)
# The Notes database is at ~/Library/Group Containers/group.com.apple.notes/
# Direct database access is NOT recommended (encrypted, undocumented schema)
```

## Safe Export Pattern
```bash
# Export with restricted permissions
osascript -l JavaScript -e "..." > /tmp/notes-export.json
chmod 600 /tmp/notes-export.json
# Process then delete
rm /tmp/notes-export.json
```

## Resources

- [Mac Automation Scripting Guide](https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/)
- [JXA Examples](https://jxa-examples.akjems.com/)