# Release notes

> What's new in each version of Cloak Watch, Subcloak's free Mac app for supply-chain attacks: 1.2's new checks, incident playbook and GitHub and domain checks.

Source: https://docs.subcloak.com/cloak-watch/release-notes/

What changed in each version of Cloak Watch. To see which version you have, open [Settings › About](https://docs.subcloak.com/cloak-watch/settings/#about); to get the latest, see [Update Cloak Watch](https://docs.subcloak.com/cloak-watch/install/#update-cloak-watch).

## 1.2.0

Watch now checks far more of what an attack can reach: Python startup files, Git settings, editor and browser extensions, AI agents' project settings, Homebrew, Docker and container images, and keys left in git history. When something does get through, **I think I've been hit** walks you through containing it, revoking and rotating keys, and checking the Mac is clean. Every new check and fix is free.

### New detections

- **Python startup files** ([PER-7](https://docs.subcloak.com/cloak-watch/detections/#per-7)): `.pth`, `sitecustomize.py`, `usercustomize.py` and Python 3.15's `.start` files in every Python Watch finds, from Homebrew and python.org to pyenv, uv, conda and your projects' virtual environments. Ones that download, decode or start programs stay [PKG-4](https://docs.subcloak.com/cloak-watch/detections/#pkg-4) at Act now.
- **Git settings that run programs** ([GIT-1 to GIT-3](https://docs.subcloak.com/cloak-watch/detections/#git-settings-git)): a repository's own config naming a program Git runs (such as `core.fsmonitor`), global settings that weaken Git's safety checks, and submodules shaped like a known attack on `git clone`. Watch never runs Git and never edits its config: each card gives the exact command.
- **GitHub Actions runners on this Mac** ([RUN-1](https://docs.subcloak.com/cloak-watch/detections/#run-1)) and **known malicious workflows** ([REPO-12](https://docs.subcloak.com/cloak-watch/detections/#repo-12)), Act now even without a headline.
- **Install cooldowns, per tool** ([PKG-8](https://docs.subcloak.com/cloak-watch/detections/#pkg-8)) for npm, pnpm, Yarn, Bun, Deno, pip, uv, Poetry and Bundler, including a cooldown you set that your version ignores, and **settings that weaken safe defaults** ([PKG-11](https://docs.subcloak.com/cloak-watch/detections/#pkg-11)), such as certificate checks turned off. [Install Guard](https://docs.subcloak.com/cloak-watch/install-guard/) shows each tool's status, won't set a cooldown an older copy of the tool can't read, and edits linked dotfiles where they point.
- **Credential classes** ([SEC-3](https://docs.subcloak.com/cloak-watch/detections/#sec-3)): publish tokens in plain text, which worms use to spread, and long-lived keys a stealer would take, without showing or keeping any value.
- **Keys in git history** ([SEC-4](https://docs.subcloak.com/cloak-watch/detections/#sec-4)): about 220 key patterns derived from Gitleaks, read straight from each project's `.git` folder, with an offline checksum check for GitHub and npm tokens. See [Keys in git history](https://docs.subcloak.com/cloak-watch/git-history-secrets/).
- **Editor and browser extensions** ([EXT-4 to EXT-12](https://docs.subcloak.com/cloak-watch/detections/#extensions-ext)): extensions installed from a file, hidden code made of invisible characters, unpacked or sideloaded browser extensions, extensions Chrome flagged that are still on, and JetBrains plugins. See [Extensions](https://docs.subcloak.com/cloak-watch/extensions/).
- **AI agents and project files** ([MCP-6 to MCP-8, AGT-9 to AGT-11, DEV-1](https://docs.subcloak.com/cloak-watch/detections/#mcp-servers-mcp)): MCP servers and agent settings that a repository you don't own brings with it, approval prompts turned off, and Dev Container commands that run on the Mac. See [AI agents and MCP](https://docs.subcloak.com/cloak-watch/ai-agents-and-mcp/).
- **Homebrew and Docker** ([BREW-1 to BREW-4, DOCK-1 to DOCK-3](https://docs.subcloak.com/cloak-watch/detections/#homebrew-brew)) and **container images** ([PKG-10](https://docs.subcloak.com/cloak-watch/detections/#pkg-10)), read from each running container engine. See [Homebrew and Docker](https://docs.subcloak.com/cloak-watch/homebrew-and-docker/) and [Container images](https://docs.subcloak.com/cloak-watch/container-images/).
- **Network alerts** ([NET-1 and NET-5](https://docs.subcloak.com/cloak-watch/detections/#network-net)), with the optional network extension: a program asking for cloud credentials, an install script sending data to a request catcher, or any connection to an address an incident names. See [Network alerts](https://docs.subcloak.com/cloak-watch/network-alerts/).
- **Mac malware**: programs running from places Mac stealers use ([PROC-1, PROC-2](https://docs.subcloak.com/cloak-watch/detections/#running-programs-proc)), crypto-wallet apps that were swapped or re-signed ([MAL-1](https://docs.subcloak.com/cloak-watch/detections/#mal-1)), and Apple's XProtect updates turned off ([MAL-2](https://docs.subcloak.com/cloak-watch/detections/#mal-2)).

### Response and playbooks

- **I think I've been hit**, in the Inbox and the **Watch** menu: a plan built from what Watch found, in four steps (contain, revoke, rotate, verify). Nothing changes until you press a button on a row. See [Respond to an incident](https://docs.subcloak.com/cloak-watch/respond/).
- **Revoke GitHub tokens** found on this Mac through GitHub's revoke service, one opt-in press at a time, and **check an old key is dead** with the company that issued it.
- **Watch mode**: once a minute, Watch looks for programs running from paths stealers use, and Apple's XProtect status shows in Settings. See [Watch mode](https://docs.subcloak.com/cloak-watch/watch-mode/).
- **Check a package before you install it**, in Install Guard: whether the feed lists it, whether its name imitates a popular package, and where it's already installed. Nothing is sent anywhere.

### Beyond this Mac

- **Footprint**, a new Inventory tab: the repositories, domains, servers, clusters, cloud accounts and registries your config files name, read without contacting any of them. See [Footprint](https://docs.subcloak.com/cloak-watch/footprint/).
- **Domains**: certificate, issuer, expiry, CAA and dangling CNAME checks for the domains you add. See [Domain checks](https://docs.subcloak.com/cloak-watch/domains/).
- **GitHub**: read-only checks of your repositories and account, for worm activity, workflows, lockfiles and settings, straight from this Mac. Connecting needs Subcloak's GitHub App; until it's available, the GitHub screen says **Coming soon**. See [GitHub](https://docs.subcloak.com/cloak-watch/github/).

### Faster feed

- **Registry takedowns count as confirmation.** When PyPI quarantines a project, npm replaces a release with a security placeholder, or a registry removes a release a report named, every Mac gets the alert at once, free, without waiting hours for the public databases. Live shows these as **Registry takedown**.
- **More sources:** malicious-code advisories in PyPI's, RustSec's and Go's databases; Datadog's malicious editor-extension and agent-skill lists; and two community lists of malicious Chrome extensions. Browser extensions are matched by ID, and agent skills by where they came from.
- **Mac stealer checks:** the feed now carries checks for what 16 macOS stealers and developer backdoors from 2025 and 2026 leave behind, each from a published analysis.
- **Under review** cards, coming with the Live Feed plan: a release Subcloak's scanner flagged, before anyone confirms it. The scanner is in a test period and doesn't send verdicts to Macs yet. See [Under review](https://docs.subcloak.com/cloak-watch/under-review/).
- **Blocking suspected releases** at install time is shown in Install Guard as **Coming soon**.

### Privacy

- Everything new runs on your Mac. The only new connections are ones you start: **Check** on a key (to GitGuardian's HasMySecretLeaked, or to the key's own issuer), **Revoke** on GitHub tokens, domains you add, and GitHub once you connect it. None of them go to Subcloak, and the key checks never go through a proxy. See [What leaves your Mac](https://docs.subcloak.com/cloak-watch/settings/#what-leaves-your-mac).
- Secrets are masked more strictly: values under 24 characters and passwords show no characters at all, and Watch tells keys apart with a fingerprint made with a key only this Mac has.
- The network extension now looks at who opens each outgoing web connection, to raise network alerts. It keeps a record only of the connections that match, and nothing about them leaves the Mac.
- Secret rules are derived from Gitleaks (MIT License); its notice is in **Settings › Advanced**, under **Acknowledgements**.

## 1.1.0

Every headline now gets an answer for your Mac, and Watch checks more of what an attack can reach: the certificate authorities your tools trust, the versions of your apps and tools, the services you're signed in to, and your repositories' workflows.

### Every headline gets an answer

- **Check my Mac answers every headline** with **This Mac is affected**, **Relevant to you**, **Not affected** or **Not checked**, the places behind the answer with a fix for each, and what Watch checked. Affected and Relevant to you answers also become Inbox cards. See [Check my Mac](https://docs.subcloak.com/cloak-watch/check-my-mac/).
- **Trust stores.** When a certificate authority is distrusted, Watch tells you which trust stores on your Mac still trust it (macOS's, OpenSSL's, Homebrew's, each Python certifi, each Node and Electron app, each JDK) and how to fix each one. A root certificate added to the keychains raises [TRUST-1](https://docs.subcloak.com/cloak-watch/detections/#trust-1).
- **Exploited flaws.** Watch flags macOS, Safari and other browsers, and developer tools that are missing the fix for a flaw known to be exploited ([VER-1](https://docs.subcloak.com/cloak-watch/detections/#ver-1)). Only exploited flaws, only in what you have installed: Watch is not a CVE scanner.
- **Services you're signed in to.** When a service you use is breached, Watch can't see your account, so it says **Relevant to you**: which files on this Mac hold a login or token for it, and what to rotate, in order, with a link for each step. It knows 45 services and never reads the token.
- **Repositories and CI.** Eleven new checks for the local clones in your code folders: actions pinned by tag, pull request workflows that run untrusted code with secrets, untrusted text in shell commands, broad token permissions, caches in release workflows, compromised actions, insecure workflow commands, tokens in Git remotes, Terraform state in a repository, and package settings that let a public package stand in for a private one. See [REPO-1 to REPO-11](https://docs.subcloak.com/cloak-watch/detections/#repositories-and-ci-repo). When a headline is about planted workflows, Watch checks every local clone for them.
- **Three new Inventory tabs:** **Apps & tools**, **Trust stores** and **Services**. See [Inventory](https://docs.subcloak.com/cloak-watch/inventory/#apps--tools).
- The workflow checks are derived from zizmor's audits (MIT License). Its notice is in **Settings › Advanced**, under **Acknowledgements**.

### Feed

- **Briefs.** Short headlines written from a single source while an incident is developing, marked **Single source · developing**. Watch checks your Mac for them once more sources confirm them. See [Briefs](https://docs.subcloak.com/cloak-watch/feed/#briefs).
- **Incident packs from headlines.** A headline can come with a Subcloak incident pack, named in its facts with when it reaches your Mac. See [Incident packs from headlines](https://docs.subcloak.com/cloak-watch/feed/#incident-packs-from-headlines).
- **Check my Mac** on a Live entry now says **Affected: yes** instead of **Found on this Mac**, and **Not affected** instead of **Not on this Mac**. When only a lockfile pins a bad version, it says **Not affected**, with **Open Incident** for the card that reminds you to remove the pin.
- [`watchctl checks`](https://docs.subcloak.com/cloak-watch/check-my-mac/#from-terminal) runs the headline checks from Terminal.

### Plan and history

- **Settings › Plan** is on every Mac. It lists what the Live Feed plan adds, such as incident packs within minutes, a security report, Slack, Discord and webhook alerts, a year of history and a watchlist, and when it's coming. Detections and fixes stay the same on every plan. See [Plans and pricing](https://docs.subcloak.com/cloak-watch/plans/).
- **History on the free plan.** Fixed incidents, events and alerts, and AI Activity are kept for up to 30 days on the free plan, and up to a year with the Live Feed plan. For the first 30 days after you update, Watch keeps up to a year, so updating doesn't trim your history on the spot.

### Fixes

- An MCP server header such as `Bearer ${GITHUB_TOKEN}` is no longer reported as a saved key: it's a reference to a variable.
- A headline about a flaw in PHP itself is checked against your PHP version, not against a Packagist package named `php`.
- [PKG-9](https://docs.subcloak.com/cloak-watch/detections/#pkg-9) now only flags workflows with attack strings; actions pinned by tag are [REPO-1](https://docs.subcloak.com/cloak-watch/detections/#repo-1).

## 1.0.0

The first release. Cloak Watch is a free Mac app, for macOS 14 or later on Apple silicon and Intel, with no account.

### Check your Mac

- **One answer on Home.** **Your Mac is clear**, or what needs fixing and a single **Fix all** button. See [Home, Inbox and incidents](https://docs.subcloak.com/cloak-watch/inbox/).
- **Everything installed, read without running anything.** Packages in your projects, global installs and download caches across npm, pnpm, Yarn, Bun, PyPI, crates.io, Go, RubyGems, Packagist and Homebrew; editor and browser extensions; MCP servers, agent settings, hooks, rules files and skills; launch agents, shell profiles and Git hooks; and which credential files exist. See [Inventory](https://docs.subcloak.com/cloak-watch/inventory/).
- **33 checks**, from matches against Subcloak's signed feed to built-in checks for the files and settings attacks leave behind. See the [detection catalogue](https://docs.subcloak.com/cloak-watch/detections/).
- **Watches as you work.** Watch checks a project within seconds of an install or a settings change, so a known-bad install gets a Fix now incident in about a second, and it scans everything once a day while the Mac is idle and on power.
- **Quiet from day one, never silent on what matters.** Watch records a starting point and keeps unusual things that are only worth a look quiet, while anything that needs fixing now always alerts.

### Fix what it finds

- **Fix it and Fix all** show the plan first, then stop background programs, move files to Quarantine, and remove single hooks, tasks, profile lines and MCP servers, in a safe order. Steps only you can do come with links.
- **Never deletes.** Everything goes to [Quarantine](https://docs.subcloak.com/cloak-watch/quarantine/), with **Put Back** and **Undo**.
- **Install Guard** sets package-manager cooldowns for npm, pnpm, Yarn, Bun, uv and pip. See [Install Guard](https://docs.subcloak.com/cloak-watch/install-guard/).

### Stay up to date

- **The Feed**: **Live** lists newly reported malicious packages, usually within the hour; **Headlines** are in-depth write-ups of the big incidents, published automatically after automated checks and also at [headlines.subcloak.com](https://headlines.subcloak.com). Both have **Check my Mac**. See [Feed](https://docs.subcloak.com/cloak-watch/feed/).
- **Signed and verified.** Every feed file, and the feed's configuration, is checked against Subcloak's root keys built into the app.
- **A paid live feed is coming**, for incident packs within minutes instead of a day later. Everything else stays free. See [Plans and pricing](https://docs.subcloak.com/cloak-watch/plans/).

### See what AI tools send

- **AI Activity** records prompts, model requests and tool calls from Claude Code, Cursor, Codex and Gemini CLI, kept on your Mac with secrets masked, or metadata only if you prefer. See [AI Activity](https://docs.subcloak.com/cloak-watch/ai-activity/).
- **Guard** redacts secrets before they reach a model and blocks, asks or warns before risky tool calls. See [Guard rules](https://docs.subcloak.com/cloak-watch/ai-activity/guard/).
- **The local gateway** on `127.0.0.1:47319` chains to the upstream you already use, and **Usage** shows tokens and estimated cost.
- **The network extension** shows which apps talk to AI providers, without decrypting anything, and fails open. See [Network extension](https://docs.subcloak.com/cloak-watch/ai-activity/network-extension/).

### Everyday use

- Opens at login, lives in the [menu bar](https://docs.subcloak.com/cloak-watch/menu-bar/), and can be paused for an hour or until tomorrow.
- Exclusions for folders and packages, coverage gaps shown after each scan, retention settings, and an update check once a day.
- [`watchctl`](https://docs.subcloak.com/cloak-watch/watchctl/), the command-line tool, ships inside the app.

## Related

  - [Cloak Watch](https://docs.subcloak.com/cloak-watch/): What it is and what it checks.
  - [Install Cloak Watch](https://docs.subcloak.com/cloak-watch/install/): Download and first run.
  - [Respond to an incident](https://docs.subcloak.com/cloak-watch/respond/): New in 1.2: the I think I've been hit plan.