Release notes

What changed in each version of Cloak Watch. To see which version you have, open Settings › About; to get the latest, see Update Cloak Watch.

1.2.0

Watch now checks far more of what an attack can reach: Python startup files, Git settings, editor and browser extensions, AI agents’ project settings, Homebrew, Docker and container images, and keys left in git history. When something does get through, I think I’ve been hit walks you through containing it, revoking and rotating keys, and checking the Mac is clean. Every new check and fix is free.

New detections

• Python startup files (PER-7): .pth, sitecustomize.py, usercustomize.py and Python 3.15’s .start files in every Python Watch finds, from Homebrew and python.org to pyenv, uv, conda and your projects’ virtual environments. Ones that download, decode or start programs stay PKG-4 at Act now.
• Git settings that run programs (GIT-1 to GIT-3): a repository’s own config naming a program Git runs (such as core.fsmonitor), global settings that weaken Git’s safety checks, and submodules shaped like a known attack on git clone. Watch never runs Git and never edits its config: each card gives the exact command.
• GitHub Actions runners on this Mac (RUN-1) and known malicious workflows (REPO-12), Act now even without a headline.
• Install cooldowns, per tool (PKG-8) for npm, pnpm, Yarn, Bun, Deno, pip, uv, Poetry and Bundler, including a cooldown you set that your version ignores, and settings that weaken safe defaults (PKG-11), such as certificate checks turned off. Install Guard shows each tool’s status, won’t set a cooldown an older copy of the tool can’t read, and edits linked dotfiles where they point.
• Credential classes (SEC-3): publish tokens in plain text, which worms use to spread, and long-lived keys a stealer would take, without showing or keeping any value.
• Keys in git history (SEC-4): about 220 key patterns derived from Gitleaks, read straight from each project’s .git folder, with an offline checksum check for GitHub and npm tokens. See Keys in git history.
• Editor and browser extensions (EXT-4 to EXT-12): extensions installed from a file, hidden code made of invisible characters, unpacked or sideloaded browser extensions, extensions Chrome flagged that are still on, and JetBrains plugins. See Extensions.
• AI agents and project files (MCP-6 to MCP-8, AGT-9 to AGT-11, DEV-1): MCP servers and agent settings that a repository you don’t own brings with it, approval prompts turned off, and Dev Container commands that run on the Mac. See AI agents and MCP.
• Homebrew and Docker (BREW-1 to BREW-4, DOCK-1 to DOCK-3) and container images (PKG-10), read from each running container engine. See Homebrew and Docker and Container images.
• Network alerts (NET-1 and NET-5), with the optional network extension: a program asking for cloud credentials, an install script sending data to a request catcher, or any connection to an address an incident names. See Network alerts.
• Mac malware: programs running from places Mac stealers use (PROC-1, PROC-2), crypto-wallet apps that were swapped or re-signed (MAL-1), and Apple’s XProtect updates turned off (MAL-2).

Response and playbooks

• I think I’ve been hit, in the Inbox and the Watch menu: a plan built from what Watch found, in four steps (contain, revoke, rotate, verify). Nothing changes until you press a button on a row. See Respond to an incident.
• Revoke GitHub tokens found on this Mac through GitHub’s revoke service, one opt-in press at a time, and check an old key is dead with the company that issued it.
• Watch mode: once a minute, Watch looks for programs running from paths stealers use, and Apple’s XProtect status shows in Settings. See Watch mode.
• Check a package before you install it, in Install Guard: whether the feed lists it, whether its name imitates a popular package, and where it’s already installed. Nothing is sent anywhere.

Beyond this Mac

• Footprint, a new Inventory tab: the repositories, domains, servers, clusters, cloud accounts and registries your config files name, read without contacting any of them. See Footprint.
• Domains: certificate, issuer, expiry, CAA and dangling CNAME checks for the domains you add. See Domain checks.
• GitHub: read-only checks of your repositories and account, for worm activity, workflows, lockfiles and settings, straight from this Mac. Connecting needs Subcloak’s GitHub App; until it’s available, the GitHub screen says Coming soon. See GitHub.

Faster feed

• Registry takedowns count as confirmation. When PyPI quarantines a project, npm replaces a release with a security placeholder, or a registry removes a release a report named, every Mac gets the alert at once, free, without waiting hours for the public databases. Live shows these as Registry takedown.
• More sources: malicious-code advisories in PyPI’s, RustSec’s and Go’s databases; Datadog’s malicious editor-extension and agent-skill lists; and two community lists of malicious Chrome extensions. Browser extensions are matched by ID, and agent skills by where they came from.
• Mac stealer checks: the feed now carries checks for what 16 macOS stealers and developer backdoors from 2025 and 2026 leave behind, each from a published analysis.
• Under review cards, coming with the Live Feed plan: a release Subcloak’s scanner flagged, before anyone confirms it. The scanner is in a test period and doesn’t send verdicts to Macs yet. See Under review.
• Blocking suspected releases at install time is shown in Install Guard as Coming soon.

Privacy

• Everything new runs on your Mac. The only new connections are ones you start: Check on a key (to GitGuardian’s HasMySecretLeaked, or to the key’s own issuer), Revoke on GitHub tokens, domains you add, and GitHub once you connect it. None of them go to Subcloak, and the key checks never go through a proxy. See What leaves your Mac.
• Secrets are masked more strictly: values under 24 characters and passwords show no characters at all, and Watch tells keys apart with a fingerprint made with a key only this Mac has.
• The network extension now looks at who opens each outgoing web connection, to raise network alerts. It keeps a record only of the connections that match, and nothing about them leaves the Mac.
• Secret rules are derived from Gitleaks (MIT License); its notice is in Settings › Advanced, under Acknowledgements.

1.1.0

Every headline now gets an answer for your Mac, and Watch checks more of what an attack can reach: the certificate authorities your tools trust, the versions of your apps and tools, the services you’re signed in to, and your repositories’ workflows.

Every headline gets an answer

• Check my Mac answers every headline with This Mac is affected, Relevant to you, Not affected or Not checked, the places behind the answer with a fix for each, and what Watch checked. Affected and Relevant to you answers also become Inbox cards. See Check my Mac.
• Trust stores. When a certificate authority is distrusted, Watch tells you which trust stores on your Mac still trust it (macOS’s, OpenSSL’s, Homebrew’s, each Python certifi, each Node and Electron app, each JDK) and how to fix each one. A root certificate added to the keychains raises TRUST-1.
• Exploited flaws. Watch flags macOS, Safari and other browsers, and developer tools that are missing the fix for a flaw known to be exploited (VER-1). Only exploited flaws, only in what you have installed: Watch is not a CVE scanner.
• Services you’re signed in to. When a service you use is breached, Watch can’t see your account, so it says Relevant to you: which files on this Mac hold a login or token for it, and what to rotate, in order, with a link for each step. It knows 45 services and never reads the token.
• Repositories and CI. Eleven new checks for the local clones in your code folders: actions pinned by tag, pull request workflows that run untrusted code with secrets, untrusted text in shell commands, broad token permissions, caches in release workflows, compromised actions, insecure workflow commands, tokens in Git remotes, Terraform state in a repository, and package settings that let a public package stand in for a private one. See REPO-1 to REPO-11. When a headline is about planted workflows, Watch checks every local clone for them.
• Three new Inventory tabs: Apps & tools, Trust stores and Services. See Inventory.
• The workflow checks are derived from zizmor’s audits (MIT License). Its notice is in Settings › Advanced, under Acknowledgements.

Feed

• Briefs. Short headlines written from a single source while an incident is developing, marked Single source · developing. Watch checks your Mac for them once more sources confirm them. See Briefs.
• Incident packs from headlines. A headline can come with a Subcloak incident pack, named in its facts with when it reaches your Mac. See Incident packs from headlines.
• Check my Mac on a Live entry now says Affected: yes instead of Found on this Mac, and Not affected instead of Not on this Mac. When only a lockfile pins a bad version, it says Not affected, with Open Incident for the card that reminds you to remove the pin.
• watchctl checks runs the headline checks from Terminal.

Plan and history

• Settings › Plan is on every Mac. It lists what the Live Feed plan adds, such as incident packs within minutes, a security report, Slack, Discord and webhook alerts, a year of history and a watchlist, and when it’s coming. Detections and fixes stay the same on every plan. See Plans and pricing.
• History on the free plan. Fixed incidents, events and alerts, and AI Activity are kept for up to 30 days on the free plan, and up to a year with the Live Feed plan. For the first 30 days after you update, Watch keeps up to a year, so updating doesn’t trim your history on the spot.

Fixes

• An MCP server header such as Bearer ${GITHUB_TOKEN} is no longer reported as a saved key: it’s a reference to a variable.
• A headline about a flaw in PHP itself is checked against your PHP version, not against a Packagist package named php.
• PKG-9 now only flags workflows with attack strings; actions pinned by tag are REPO-1.

1.0.0

The first release. Cloak Watch is a free Mac app, for macOS 14 or later on Apple silicon and Intel, with no account.

Check your Mac

• One answer on Home. Your Mac is clear, or what needs fixing and a single Fix all button. See Home, Inbox and incidents.
• Everything installed, read without running anything. Packages in your projects, global installs and download caches across npm, pnpm, Yarn, Bun, PyPI, crates.io, Go, RubyGems, Packagist and Homebrew; editor and browser extensions; MCP servers, agent settings, hooks, rules files and skills; launch agents, shell profiles and Git hooks; and which credential files exist. See Inventory.
• 33 checks, from matches against Subcloak’s signed feed to built-in checks for the files and settings attacks leave behind. See the detection catalogue.
• Watches as you work. Watch checks a project within seconds of an install or a settings change, so a known-bad install gets a Fix now incident in about a second, and it scans everything once a day while the Mac is idle and on power.
• Quiet from day one, never silent on what matters. Watch records a starting point and keeps unusual things that are only worth a look quiet, while anything that needs fixing now always alerts.

Fix what it finds

• Fix it and Fix all show the plan first, then stop background programs, move files to Quarantine, and remove single hooks, tasks, profile lines and MCP servers, in a safe order. Steps only you can do come with links.
• Never deletes. Everything goes to Quarantine, with Put Back and Undo.
• Install Guard sets package-manager cooldowns for npm, pnpm, Yarn, Bun, uv and pip. See Install Guard.

Stay up to date

• The Feed: Live lists newly reported malicious packages, usually within the hour; Headlines are in-depth write-ups of the big incidents, published automatically after automated checks and also at headlines.subcloak.com. Both have Check my Mac. See Feed.
• Signed and verified. Every feed file, and the feed’s configuration, is checked against Subcloak’s root keys built into the app.
• A paid live feed is coming, for incident packs within minutes instead of a day later. Everything else stays free. See Plans and pricing.

See what AI tools send

• AI Activity records prompts, model requests and tool calls from Claude Code, Cursor, Codex and Gemini CLI, kept on your Mac with secrets masked, or metadata only if you prefer. See AI Activity.
• Guard redacts secrets before they reach a model and blocks, asks or warns before risky tool calls. See Guard rules.
• The local gateway on 127.0.0.1:47319 chains to the upstream you already use, and Usage shows tokens and estimated cost.
• The network extension shows which apps talk to AI providers, without decrypting anything, and fails open. See Network extension.

Everyday use

• Opens at login, lives in the menu bar, and can be paused for an hour or until tomorrow.
• Exclusions for folders and packages, coverage gaps shown after each scan, retention settings, and an update check once a day.
• watchctl, the command-line tool, ships inside the app.

Related

Cloak WatchWhat it is and what it checks.

Install Cloak WatchDownload and first run.

Respond to an incidentNew in 1.2: the I think I've been hit plan.