Pastewatch is designed with security as a core constraint, not a feature.
Pastewatch operates locally. There is no server. No telemetry. No network calls.
The clipboard content never leaves your machine.
| Threat | Protection |
|---|---|
| Accidental paste of secrets into AI chat | Obfuscation before paste (GUI) |
| Credential leakage to LLM training data | Data never reaches the service |
| API key exposure in prompts | Pattern-based detection and replacement |
| Secret leakage via AI coding agents | MCP server redacts secrets, agent sees only placeholders |
| Secrets committed to repositories | Pre-commit hook and CLI scanning |
| Threat | Why Not |
|---|---|
| Malicious apps reading clipboard | OS-level concern, not in scope |
| Screenshots of sensitive data | Visual, not text-based |
| Intentional bypass by user | User agency is preserved |
| Unknown secret formats | Conservative detection only |
| Clipboard history apps | Third-party tools outside control |
Known limitations:
- Detection is conservative — Unknown secret formats will not be detected
- No encryption — Obfuscated content uses plaintext placeholders
- Memory only — Mappings are not persisted (by design)
- GUI is macOS only — CLI and MCP server run on macOS and Linux
- System clipboard (read and write) — GUI only
- Files and directories — CLI scan and MCP read/write tools
- Configuration file at
~/.config/pastewatch/config.json - System notification service — GUI only
- MCP audit log file (if
--audit-logspecified)
- Network
- Other applications' data
- Keychain
- Screen content
If you discover a security vulnerability:
- Do not open a public issue
- Email the maintainer directly (see GitHub profile)
- Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Allow 90 days for response before public disclosure
Security fixes will be released as patch versions (e.g., 0.1.1) and documented in CHANGELOG.md.
All releases include SHA256 checksums. Verify downloads:
shasum -a 256 -c Pastewatch-vX.X.X.dmg.sha256This software is provided as-is. It does not guarantee security or compliance.
See LICENSE for full terms.