The Mac desk guard that catches snoops.
Arm it when you step away. The moment someone touches your keyboard, or the camera catches a face up close and paying attention to your screen, Busted hits them with a fullscreen show, a rising siren, and snaps a photo that lands in your Telegram. Nothing on the machine is touched. The snoop just learns, loudly, that they were watched.
▶︎ Watch the demo with sound (MP4)
Install · How it works · Privacy and lawful use · Configuration
Busted is a menu-bar app for the open desk: shared offices, dorms, libraries, hackerspaces. Leave the laptop for coffee without leaving it open to whoever wanders by.
- Two ways to catch someone. A global keyboard and mouse tap fires the instant anyone types or clicks. Separately, a camera attention engine watches for a face that is close and looking at the screen, so it can react before a key is even pressed.
- The show. A caught screen, a fake self-destruct countdown, then an obvious joke reveal and a steady "this Mac is monitored" message. It is a deterrent and a laugh, not malware. Nothing is deleted, moved, or harmed.
- Photo evidence. Every trigger captures a still to a local folder and sends it to your Telegram, so you see who it was and when.
- Hands-free arming. Pair your iPhone over Bluetooth and Busted arms itself when you walk away and disarms when you come back.
The menu bar. Disarmed it sits quietly; armed it turns red while Busted is watching.
The show. What a snoop sees the moment they get caught. The full sequence is in the demo above.
The app icon, in your Dock and Finder.
Keyboard and mouse. A listen-only CGEventTap watches for key presses, clicks, and
scrolls. This path is instant and needs the Input Monitoring permission.
Camera attention. This is not a motion sensor. Using Apple's Vision framework, the
engine scores three things for each face it sees: how close it is, whether it is turned
toward the screen, and (when the webcam can resolve the pupils) where the eyes point.
Those scores feed a leaky integrator that only fires when someone is genuinely close and
attentive for a couple of seconds. A coworker walking past at a distance does not set it
off. The thresholds live in config.json and can be tuned to your desk (see INSTALL.md).
iPhone presence. An optional Bluetooth proximity engine reads your paired iPhone's signal strength. Walk out of range and Busted arms. Come back and it disarms. No taps, no menus.
When a trigger fires, the show and siren run, a photo is captured, and a Telegram message goes out. You can stop the show or disarm remotely from Telegram.
Catching someone at your Mac is not a new idea, but the existing tools aim at theft or forensics. Busted is built for the open desk: someone reading your screen while you step out for coffee.
| App | What triggers it | What it does | Open source |
|---|---|---|---|
| Busted | Keyboard/mouse tap and a camera attention engine | A loud fullscreen show, a siren, and a photo to your Telegram | Yes, GPL-3.0 |
| Do Not Disturb | The laptop lid opening | A silent alert and a local log of access | No, free |
| iAlertU | Motion, via the legacy Sudden Motion Sensor | An alarm and an emailed photo | No |
| Unplug Alarm | Charger unplug or lid close | An alarm and a photo | No, paid |
| Security Camera | The Mac waking | A silent photo saved to Dropbox | No, paid |
The gap Busted fills: it watches the screen with the camera and reacts before a key is pressed, then makes noise on purpose so the snoop knows they were caught. The others are either silent records or grab-and-run alarms.
- macOS 14 (Sonoma) or later. Apple Silicon recommended; the camera engine runs Vision requests on the Neural Engine.
- A webcam for camera detection. The built-in one is fine.
- Optional: a Telegram bot for remote alerts and control.
- Optional: an iPhone for automatic arm and disarm.
git clone https://github.com/kasparovabi/busted.git
cd busted
./scripts/bundle-app.sh
cp -R "build/Busted.app" ~/Applications/
open ~/Applications/Busted.appThen grant Camera and Input Monitoring under System Settings › Privacy & Security and launch again. INSTALL.md covers the Telegram bot, the optional iPhone pairing, the background LaunchAgent, and a verification checklist.
The default build is ad-hoc signed, which is enough to run locally. macOS resets the Camera and Input Monitoring grants every time an ad-hoc binary is rebuilt, so for a daily-driver install you will want a stable signing identity. Put your Apple Development certificate SHA in
scripts/signing.env(gitignored) and the grants persist across rebuilds. Details in INSTALL.md.
Releases carry a prebuilt Busted.app. It is not notarized, since this is a free project,
so macOS quarantines a downloaded copy. After unzipping, clear the quarantine flag and open it:
xattr -dr com.apple.quarantine Busted.appBuilding from source, above, skips this entirely, because a locally built app is not quarantined.
| Permission | Why | Without it |
|---|---|---|
| Camera | The attention engine and photo evidence | No camera detection, no photos |
| Input Monitoring | The instant keyboard and mouse tap | No instant trigger, camera only |
| Bluetooth | iPhone presence arm and disarm | Manual arming only |
Busted never asks for full disk access, network entitlements beyond Telegram, or anything it does not use. The captured photo is written locally and sent only to the Telegram chat you configure.
Busted photographs whoever triggers it and can send that photo off the device to your Telegram. That is the whole point, and it is also a responsibility. Photographing or recording people is restricted in many places, especially at work, and the rules vary by country and state. You are responsible for using Busted lawfully: post a visible notice that the desk is monitored, get consent where it is required, and check your local law.
By design, Busted keeps data on your Mac, purges evidence after 14 days, never shows the captured photo on screen, and sends nothing to anyone but you. Read PRIVACY.md before you run it anywhere shared.
Busted splits into two targets. BustedCore is Foundation only: every detection decision,
the proximity and attention state machines, the Telegram message building, all of it with
no AppKit, Vision, or Bluetooth imports. That is what makes it testable without a camera or
a person, and it ships with 92 deterministic unit tests. BustedApp is the thin layer that
wires Core to AppKit, Vision, AVFoundation, and CoreBluetooth. Swift 6, strict concurrency.
Sources/
BustedCore/ detection engines, config, Telegram, evidence (pure, tested)
BustedApp/ menu bar, camera, keyboard tap, BLE, the show (adapters)
Tests/
BustedCoreTests/ 92 tests
Issues and pull requests are welcome. See CONTRIBUTING.md.
GPL-3.0. See LICENSE. Ship a modified version and your changes stay open too.