# Apple Privacy Security

> Design or audit macOS permissions, privacy metadata, entitlements, sandbox access, Keychain use, sensitive logging, network/file boundaries, and secure defaults.

- Skill: `rcarmo/apple-privacy-security` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add rcarmo/apple-privacy-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rcarmo/apple-privacy-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: rcarmo (https://skillmd.com/u/rcarmo)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/rcarmo/apple-privacy-security

---


# macOS privacy and security

Read `references/privacy-and-permissions.md` when adding a capability, entitlement, permission prompt, credential, network client, file access, analytics, diagnostics, clipboard, camera, location, contacts, or release privacy declaration.

The starter enables the application sandbox plus user-selected read/write file access for its import/export example. Remove that entitlement if the derived product removes the file workflow, and add other capabilities only for behaviour that exists.

## Workflow

1. Minimise data collection and capability scope before implementation.
2. Record the data, purpose, retention, sharing, deletion, and user control.
3. Add only the required plist usage descriptions, sandbox entitlements, privacy-manifest reasons, and distribution declarations.
4. Request permission in context and design denial, restriction, later grant/revocation, and Settings-change behaviour.
5. Store credentials through an injected Keychain service; keep secrets out of source, preferences, logs, and crash metadata.
6. Keep ATS and platform trust validation enabled; document any narrower trust requirement and its rotation/failure plan.
7. Test first request, denial, revocation, offline operation, migration, and data deletion/export as applicable.
8. Inspect the entitlements and plist in the assembled, signed `.app` before release.

## Guardrails

- No secrets in `@AppStorage`, plist, source, scripts, fixtures, screenshots, or workflow logs.
- No broad sandbox entitlement for hypothetical features.
- Do not force-open Settings as the only denied path; explain what remains usable.
- Redact sensitive values in `Logger`; do not use `print` for application diagnostics.
- Do not disable ATS or certificate validation without a narrow reviewed requirement.
- Do not add analytics or telemetry until consent, policy, retention, and deletion requirements are defined.

## Output

Provide the data/capability inventory, plist and entitlement changes, denial/revocation behaviour, storage/retention, tests, and release declarations. Flag legal or policy questions rather than guessing.