macOS privacy and security
Read references/privacy-and-permissions.md when adding a capability, entitlement, permission prompt, credential, network client, file access, analytics, diagnostics, clipboard, camera, location, contacts, or release privacy declaration.
The starter enables the application sandbox plus user-selected read/write file access for its import/export example. Remove that entitlement if the derived product removes the file workflow, and add other capabilities only for behaviour that exists.
Workflow
- Minimise data collection and capability scope before implementation.
- Record the data, purpose, retention, sharing, deletion, and user control.
- Add only the required plist usage descriptions, sandbox entitlements, privacy-manifest reasons, and distribution declarations.
- Request permission in context and design denial, restriction, later grant/revocation, and Settings-change behaviour.
- Store credentials through an injected Keychain service; keep secrets out of source, preferences, logs, and crash metadata.
- Keep ATS and platform trust validation enabled; document any narrower trust requirement and its rotation/failure plan.
- Test first request, denial, revocation, offline operation, migration, and data deletion/export as applicable.
- Inspect the entitlements and plist in the assembled, signed
.app before release.
Guardrails
- No secrets in
@AppStorage, plist, source, scripts, fixtures, screenshots, or workflow logs.
- No broad sandbox entitlement for hypothetical features.
- Do not force-open Settings as the only denied path; explain what remains usable.
- Redact sensitive values in
Logger; do not use print for application diagnostics.
- Do not disable ATS or certificate validation without a narrow reviewed requirement.
- Do not add analytics or telemetry until consent, policy, retention, and deletion requirements are defined.
Output
Provide the data/capability inventory, plist and entitlement changes, denial/revocation behaviour, storage/retention, tests, and release declarations. Flag legal or policy questions rather than guessing.
1---2name: apple-privacy-security3description: Design or audit macOS permissions, privacy metadata, entitlements, sandbox access, Keychain use, sensitive logging, network/file boundaries, and secure defaults.4license: MIT5---67# macOS privacy and security89Read `references/privacy-and-permissions.md` when adding a capability, entitlement, permission prompt, credential, network client, file access, analytics, diagnostics, clipboard, camera, location, contacts, or release privacy declaration.1011The starter enables the application sandbox plus user-selected read/write file access for its import/export example. Remove that entitlement if the derived product removes the file workflow, and add other capabilities only for behaviour that exists.1213## Workflow14151. Minimise data collection and capability scope before implementation.162. Record the data, purpose, retention, sharing, deletion, and user control.173. Add only the required plist usage descriptions, sandbox entitlements, privacy-manifest reasons, and distribution declarations.184. Request permission in context and design denial, restriction, later grant/revocation, and Settings-change behaviour.195. Store credentials through an injected Keychain service; keep secrets out of source, preferences, logs, and crash metadata.206. Keep ATS and platform trust validation enabled; document any narrower trust requirement and its rotation/failure plan.217. Test first request, denial, revocation, offline operation, migration, and data deletion/export as applicable.228. Inspect the entitlements and plist in the assembled, signed `.app` before release.2324## Guardrails2526- No secrets in `@AppStorage`, plist, source, scripts, fixtures, screenshots, or workflow logs.27- No broad sandbox entitlement for hypothetical features.28- Do not force-open Settings as the only denied path; explain what remains usable.29- Redact sensitive values in `Logger`; do not use `print` for application diagnostics.30- Do not disable ATS or certificate validation without a narrow reviewed requirement.31- Do not add analytics or telemetry until consent, policy, retention, and deletion requirements are defined.3233## Output3435Provide the data/capability inventory, plist and entitlement changes, denial/revocation behaviour, storage/retention, tests, and release declarations. Flag legal or policy questions rather than guessing.
rcarmo