# Security & privacy posture
Source: https://docs.privacycommand.privacykey.org/security

Every outbound call privacycommand makes, and how to report a vulnerability.

privacycommand is a privacy tool, so it should be able to survive its own audit.

## No analytics

privacycommand ships **no analytics SDKs**. There is no telemetry endpoint, no
install counter, and no crash-report bucket. Nobody is told that you installed
it or what you pointed it at.

You can check this rather than take our word for it: drop `privacycommand.app`
onto its own window and read the [telemetry callout](https://docs.privacycommand.privacykey.org/telemetry). It should be
empty.

## Every outbound call

Five, all narrow. The first three happen on privacycommand's own account; the
last two only when you ask for a feature that fetches something:

| Call | When | What is sent |
|---|---|---|
| **DNS reverse lookups** | During a [monitored run](https://docs.privacycommand.privacykey.org/monitored-runs) | The IP addresses the *inspected* app contacted, so the Network tab can label them |
| **App Store privacy labels** | Analysing a Mac App Store app | The inspected app's bundle ID, to Apple's lookup endpoint and then that app's App Store product page. Nothing about you |
| **Sparkle appcast** | Checking for updates — **off by default** | A request to `privacykey.github.io` |
| **The inspected app's own appcast** | You click **Preview next version** on a Sparkle-distributed app — see [Compare runs](https://docs.privacycommand.privacykey.org/compare-runs) | A request to the *vendor's* feed URL, then a download of the release it points at. HTTPS only, capped at 600 MB, analysed but never executed |
| **`brew fetch`** | [`auditctl preview --fetch`](https://docs.privacycommand.privacykey.org/auditctl) | Homebrew downloads the incoming cask artifact into its own cache, from wherever the cask points |

**All analysis runs locally.** The inspected bundle's contents never leave your
machine, and privacycommand never uploads a report anywhere. The last two rows
are downloads *into* your machine, not uploads out of it.

## The privileged helper

Opt-in, narrow, and there is no general run-as-root path. See
[The privileged helper](https://docs.privacycommand.privacykey.org/privileged-helper).

It validates callers by code signature on connect — an Apple anchor plus a Team
ID matching its own — **but only when the helper binary itself carries a Team
Identifier.** That is the case for any Developer ID build, including every
release. A helper that is unsigned, ad-hoc signed, or built with Xcode's
"Sign to Run Locally" has no Team ID to compare against, and in that state it
accepts every connecting process. Treat a locally built helper as reachable by
anything running as you.

## Things worth knowing

**Reports can contain sensitive strings.** Hard-coded hostnames, internal
domains, secret *names*, and file paths from your machine. Read an export before
sharing it — see [Exporting reports](https://docs.privacycommand.privacykey.org/reports).

**The kill switch changes system state.** It writes a `pf` anchor and edits
`/etc/pf.conf`, restoring the original on removal. It is system-wide while
armed. See [Network kill switch](https://docs.privacycommand.privacykey.org/kill-switch).

**A monitored run executes untrusted code** on your machine unless you use
[VM mode](https://docs.privacycommand.privacykey.org/vm-mode).

**Ghidra is third-party.** If you enable decompilation, that's Ghidra's code
running on your machine under its own terms.

## What a clean report does not mean

privacycommand makes **no claim to detect malware**. Static analysis can be
defeated by an adversary who wants to hide, and dynamic analysis only observes
the code paths a run happens to exercise.

A clean report means the signals privacycommand extracts didn't look
noteworthy. Treat it as evidence, not as a verdict.

## Reporting a vulnerability

Please **don't** open a public issue.

Email **security@privacykey.org**, or use
[GitHub's private advisory form](https://github.com/privacykey/privacycommand/security/advisories/new).
We aim to respond within 72 hours.

Especially interested in: anything that lets an unauthorised process reach the
helper, any path from analysing a malicious bundle to code execution on the
host, and anything that causes privacycommand to transmit data beyond the calls
listed above.