Security

Closed source doesn't have to mean unverifiable. Here's what a skeptical user, a security journalist, or a Reddit thread can check without our cooperation.

Published rules manifest

Every path the app is capable of touching is published, versioned, and diffable atmac-cleaner-rules. The app can verify its own shipped rules against that public list in one tap. No path exists in the app's code that isn't in the manifest.Browse the rules table.

Independent security audit

A named third-party firm audits privileged-helper communication, the rules-bundle signature check, Full Disk Access usage, network behavior, and the deletion path before general release. The full report is published — not a summary, not a badge — redacted only where a disclosure would itself create a hole, and any such redaction is stated plainly.

No network calls, verifiably

With telemetry off — the default — the app makes zero outbound connections during a scan or a delete, except an update check and any action you explicitly trigger yourself (like verifying the rules manifest). This is a testable claim: watch it with Little Snitch, Lulu, or nettop during a scan-and-delete cycle.

Reproducible builds — the honest version

Full bit-for-bit reproducibility isn't achievable for a notarized macOS app today — Apple's notarization step embeds non-deterministic metadata on every run, even from identical input. What we commit to instead: the exact toolchain (Xcode, Swift, macOS build host, Package.resolved) and SHA-256 checksums for every shipped artifact are published per release, and the pre-notarization build is independently reproducible from a clean checkout with the pinned toolchain.

Full undo

Every delete moves items to a holding area with a 30-day default retention, not straight to gone. Any batch is undoable from the History screen, restoring original paths and metadata.