Security

MacPeek runs as you, asks for nothing it does not need, and never trusts a stale process ID.

Open source

The whole app is public under the MIT license: read it, build it, audit it.

Permission model

• MacPeek runs as your user. It never requests administrator privileges and never elevates silently.
• It can only see and terminate what your user can. Root and system processes are marked protected.
• It does not bypass macOS privacy controls. Where a detail needs a permission, the utility says so.
• No telemetry or cloud: nothing is sent to MacPeek or any analytics service. MacPeek checks GitHub for a new release about once a day (switch it off in Settings; downloads are signature-verified). Otherwise the only network traffic is a check you start yourself (NetPeek pings, DNSPeek lookups, UpdatePeek's macOS and npm checks). The npm registry sees the names of your global packages, as it does whenever you run npm yourself.
• UpdatePeek never installs macOS or Homebrew updates. It runs npm install -g <name>@latest only for one package you pressed Update on and confirmed, with a strictly validated name. If npm is refused permission, UpdatePeek only shows a sudo command to copy into Terminal: it never runs sudo and never sees your password.

Process termination safety

Every utility that can end a process uses one shared service with these rules:

1. Re-check the resource (for example the exact socket) when you click Kill.
2. Verify the same process is still there: name and start time. If identity cannot be proven, nothing is killed. This protects against PID reuse.
3. Send SIGTERM first and wait. Confirm the process exited and the resource was released.
4. Force kill (SIGKILL) only if you explicitly choose it, after another re-check.
5. PID 1 and MacPeek itself are never signalled.

Details: how PortPeek kills safely.

Releases

Releases are built by GitHub Actions from a tagged commit, signed with a Developer ID with the Hardened Runtime enabled, notarized by Apple and stapled. The pipeline fails, and publishes nothing, if signing or notarization fails. Each release ships a SHA256SUMS file. Signing credentials live only in repository secrets, never in the code.

Reporting a vulnerability

Please do not open a public issue. Use GitHub's private security advisory form. We aim to acknowledge reports within 7 days and credit reporters who want it. The full policy is in SECURITY.md.