It streams the pasteboard daemon's own log, which names the process behind every clipboard change and every read. When that log is off it falls back to the frontmost app.
Yes. At launch it applies a kernel sandbox profile to itself that denies every socket; Settings → Privacy has a button that tries to connect and shows the refusal.
Anything that follows the nspasteboard.org convention, including Raycast, Alfred, Paste, Maccy and Copy 'Em. The Leaks view shows any tool that read a concealed item anyway.
Private keys, provider tokens, wallet keys, JWTs, database URLs with passwords, Authorization headers, .env and config assignments, plus a high-entropy fallback. Anything copied from a terminal or password manager is treated as a secret regardless.
Hooks for zsh, bash, fish, nushell, PowerShell and xonsh keep commands that look like secrets out of history. A scanner finds secrets already sitting in 19 history files and scrubs them, with a backup.
No. It is included with every purchase under the MIT License.
Yes, within 30 days. Write to support with your receipt.
macOS 14 Sonoma and later, Apple Silicon and Intel. Daemon-log attribution is verified on macOS 26; older versions may fall back to frontmost-app attribution.
