Reference
Settings
Every Cloak Watch settings page, from startup, folders, alerts and permissions to Quarantine, privacy, your plan and updates, plus every request the app makes.
Settings is a section of the main window, with pages along the top: General, Alerts, Permissions, Quarantine, Privacy, Plan, Advanced and About. Plan is on every Mac. Open Settings from the sidebar, with ⌘ ,, or from Settings… in the menu bar.
General
Section titled “General”Startup, scanning, where Watch looks, and what it skips.
Settings › General as it looked in 1.1. From 1.2, a Watch mode section follows Scanning.
| Setting | What it does |
|---|---|
| Open at login | Cloak Watch starts quietly in the menu bar when you log in, so it keeps checking. On unless you turned it off at the end of the welcome. If macOS needs you to allow it, Watch says so and offers Open Login Items; Cloak Watch must be in Applications. |
| Watch for changes as they happen | On by default. Checks a project within seconds of an install or a change to its settings. Off, Watch only scans once a day and when you ask. See How Watch keeps checking. |
| Last full scan | When Watch last scanned everything (Today, 09:12, Yesterday, 18:40, Scanning now or Not yet), with Scan Now. Watch also scans everything once a day while the Mac is idle and on power, and after waking if it’s been more than a day. |
| Check running programs New in 1.2.0 | Under Watch mode. On by default. Once a minute, while Watch is watching for changes, it looks for programs running from places Mac stealers use. Greyed out while Watch for changes as they happen is off. A line under it says what the last check found and how much CPU it used. See Watch mode. |
| Apple XProtect New in 1.2.0 | Under Watch mode: the version of macOS’s own malware rules and when they were updated, with · updates off when automatic updates are off. Read only. |
| Code folders | A switch for each folder Watch reads lockfiles and installed packages from, with its project count, or Doesn’t exist. Add Folder… adds more. Global installs, caches, editors, browsers, agent configs and launch items are checked wherever they are. Folders in Documents or Desktop make macOS ask once. |
| Exclusions | Folders and packages every scan skips: nothing in an excluded folder, and no package or extension with an excluded name, is listed or checked. Type a package or extension name and click Add Package, or click Add Folder…; each entry has Remove. Build output and caches inside projects are skipped already. Changing exclusions starts a scan. |
Alerts
Section titled “Alerts”When Watch interrupts you.
What Watch tells you about describes the three tiers: Fix now notifies you at once, even in most Focus modes; Worth a look waits in the Inbox with at most one reminder a day; Good to know waits in the Inbox and never notifies.
| Setting | Default | What it does |
|---|---|---|
| Things to fix break through Focus | On | Sends Fix now notifications as time-sensitive, so a Focus that allows time-sensitive notifications lets them through. |
| Daily reminder for things worth a look | On | At most one notification a day, only when something new is waiting. |
| Weekly summary of things worth a look | On | One quiet notification a week, only when something is still waiting at Worth a look. |
| Show how many things to fix in the menu bar | On | The number beside the menu bar icon. |
Open Focus Settings and Open Notifications Settings open those System Settings panes. While you’ve paused Watch, notifications wait until the pause ends.
Slack, Discord and webhooks
Section titled “Slack, Discord and webhooks”Watch can post alerts to a Slack or Discord channel, or to any service that takes JSON, through an incoming webhook URL. This is part of the Live Feed plan. On the free plan the section shows a Live Feed badge and “Post alerts to Slack, Discord or any webhook. Comes with the Live Feed plan, coming soon.”, and Add Destination… and Test are turned off.
| Part | What it does |
|---|---|
| Add Destination… | Opens a sheet: a Name, the URL (for example https://hooks.slack.com/services/…), the Format Watch picks from the URL (Slack, Discord or plain JSON), what to Send, and Include paths. |
| Send | Checkboxes for what to post: Fix now, Worth a look, Feed headlines and Watchlist matches. New destinations start with Fix now and Watchlist matches. |
| Include paths | Off by default. Adds where things are on this Mac (~/Developer/…) and why. Secrets are never sent. |
| Each destination | Its name, host and what it sends (Fix now, Worth a look, Feed headlines, Watchlist matches), when it last delivered or why delivery failed, with Test (sends a test message) and Edit…. In Edit… you can change what’s sent, turn Send alerts here off, or Remove it. To change the URL, remove the destination and add it again. |
Watch posts straight from this Mac to the URL you give; Subcloak never sees it. Messages say what happened and how serious it is, never a secret, and no file paths unless you turn on Include paths. URLs are kept in the Keychain.
Permissions
Section titled “Permissions”What Watch can see. Each row shows On, Off, Optional or Waiting for Apple, with a button that opens the right place; Check Again refreshes them. See Choose optional permissions for what each one adds.
Under the list, Not checked on this Mac names anything the last scan couldn’t read, why, and what would fix it, for example which Safari extensions are turned on, without Full Disk Access, or container images while no container engine is running. The Full Disk Access row says which of those it would open up. See What Watch can’t see.
Quarantine
Section titled “Quarantine”Everything Watch moved or changed, newest first, each with Put Back, and Show in Finder for the folder. See Quarantine and restore.
Privacy
Section titled “Privacy”What leaves your Mac, and how Watch handles secrets. Help › What Leaves Your Mac opens this page.
The first rows of the table. The full text of every row is below.
What leaves your Mac
Section titled “What leaves your Mac”The page lists every connection Cloak Watch can make, word for word as below. Each row says what it Sends and what it Never sends. The rows marked “only when” or “only if” happen only after you do that.
| Row | Sends | Never sends |
|---|---|---|
| Update check | A plain request for the current version number to download.subcloak.com, at launch and once a day (Cloudflare sees your IP address and the time). The app version and platform only if you turn on the anonymous count in Settings › About | Anything about this Mac: inventory, paths, package names, prompts |
| Signed feed and config | Plain downloads from feed.subcloak.com of the same signed files everyone gets: a check for a new version every 15 minutes (a few hundred bytes), the files themselves only when they change. Cloudflare sees your IP address and the time; a fixed app name, no cookies, no IDs | Inventory, paths, package names, prompts |
| Licence check (trial and subscribers only) | Only after you start a free trial or enter a key. Trial: a random install ID, nothing else (no email, no card, no account). Key: the key over HTTPS to activate or restore this Mac (Subcloak keeps only its hash) and the random install ID. Then only the signed licence token, every few days | Inventory, paths, package names, prompts. Nothing at all before you start a trial or enter a key |
| Instant updates (trial and subscribers only) | One idle connection to push.subcloak.com that says when the feed has a new version, so Watch fetches it at once instead of at the next check. It carries the signed licence token and a short “ping” every minute or so, nothing else. Off on the free plan, and Subcloak can switch it off; the regular checks carry on either way | Anything about this Mac: inventory, paths, package names, prompts, the install ID |
| Is this key public? (only when you click Check) New in 1.2.0 | To GitGuardian’s HasMySecretLeaked, directly and never through a proxy: the first 5 characters of one key’s scrypt hash, which about a million other keys share, for each key you check. GitGuardian sees your IP address and the time | The key, its full hash, where it was found, anything else about this Mac |
| Network shapes (with the network extension on) New in 1.2.0 | Nothing: which programs reached webhook sinks, cloud metadata or incident addresses is worked out and kept on this Mac | — |
| Slack, Discord and webhook alerts (only if you add one) | Straight from this Mac to the URL you gave, never through Subcloak: what happened, how serious it is and a reference. Paths only if you turn on Include paths | Secret values, your inventory, this Mac’s name |
| GitHub (only if you connect it) New in 1.2.0 | To github.com when you connect (the sign-in code) and to renew the token, which GitHub limits to 8 hours, so a renewal goes with the next check after it runs out. Read-only requests to api.github.com with that token, about once a day and when you press Check Now. Both follow this Mac’s proxy settings, as your browser does (the GitHub screen says when a proxy is set). The token stays in this Mac’s Keychain. On this Mac, in files only you can read, Watch keeps what it parsed (package versions from lockfiles, facts about workflows, webhook hosts, repository settings) and the few fields of GitHub’s answers it needs to ask again cheaply. GitHub, and your organisations’ owners, can see that you authorised Cloak Watch | Anything to Subcloak: the token, your repository names and what Watch finds stay on this Mac. Watch never keeps file contents or webhook URLs |
| Domain checks (only domains you add) New in 1.2.0 | DNS queries through your usual resolver for each domain you add, the names its CNAME records point to, and its parent domains (for CAA records), and a TLS connection to the domain on port 443 that bypasses any proxy, about once a day | Anything to Subcloak, and nothing to domains you haven’t added |
| GitHub token revoke (only when you press Revoke) New in 1.2.0 | The github.com tokens you tick, straight to GitHub’s revoke service (api.github.com), never through a proxy and without following redirects, at most 60 times an hour. GitHub emails each token’s owner | Tokens another host issued (GitHub Enterprise), anything else; nothing goes to Subcloak |
| Key checks in “I think I’ve been hit” (only when you press Check) New in 1.2.0 | That one key, straight to its issuer’s own service (api.github.com, gitlab.com, registry.npmjs.org, huggingface.co, api.anthropic.com, api.openai.com, slack.com, or AWS’s sts.amazonaws.com, which gets the access key ID and a signature, not the secret), never through a proxy and without following redirects, to ask whether it still works | Any other key, your inventory or paths; nothing goes to Subcloak. Never checked: keys a credential store says another host issued (GitHub Enterprise, self-managed GitLab), keys shaped like OpenAI’s that OpenAI doesn’t issue (DeepSeek, Moonshot, DashScope, LiteLLM) and kinds Watch has no check for |
| AI Activity | Nothing: a local receiver and a local store | — |
Under the table: “Matching happens on this Mac, and so does watching for changes. Watch has no account and no server that knows what you have.”
- The feed row’s interval is the one your plan uses: every 15 minutes on the free plan and every 5 minutes with the live feed. Subcloak sets these in the signed configuration.
- Instant updates never run on the free plan, and stay off unless Subcloak turns them on in the signed configuration.
- The app has one more row, for install blocking, which it hides while that feature is coming soon.
Secrets
Section titled “Secrets”| Setting | Default | What it does |
|---|---|---|
| Look for keys in git history New in 1.2.0 | On | “Reads each project’s .git folder directly; never runs git or anything in the repository”. Turns keys in git history (SEC-4) on or off. |
Under it: “Secret values are never shown in full, logged, stored or exported. Watch keeps the type, path, line, a masked value (no characters at all for values under 24 characters and for passwords) and a fingerprint made with a key only this Mac has (HMAC-SHA256), in files only you can read.”
The requests in detail
Section titled “The requests in detail”| Request | To | Details |
|---|---|---|
| Update check | download.subcloak.com (or a backup address on Cloudflare if that doesn’t answer) |
The app version and a platform bucket (for example watch-mac-arm64) only with Help count active installs (anonymous) on in About. Turn off Check for updates automatically to stop it; Check Now still works. |
| Signed feed and config | feed.subcloak.com |
User-Agent: CloakWatch/1.0, no cookies, credentials, query strings or identifiers. Also every minute while the Feed tab is open. |
| License check | licence.subcloak.com |
Only for subscribers, as in the table. |
| Webhook alerts | The URL you added in Settings › Alerts | On the Live Feed plan. |
| Key checks, revoke, Is this key public? | The issuer, api.github.com, or GitGuardian |
One request per press, with no cookies, no cache and no proxy, and redirects refused. |
| GitHub and domains | github.com, api.github.com; your resolver and the domains you add |
See GitHub and Domain checks. |
Watch also relays traffic your own tools were going to send anyway, only if you turn these on:
| Feature | What happens |
|---|---|
| Gateway | A tool you connect sends its model requests to Watch on 127.0.0.1:47319, and Watch forwards them, minus redacted secrets, to the tool’s own upstream. |
| Network extension | Watch relays your apps’ connections to AI providers unchanged, recording only metadata, and notes which programs reach the addresses behind network alerts. |
Everything else stays on your Mac, including the two local servers on 127.0.0.1:47318 and 127.0.0.1:47319, which only accept connections from this Mac. Links you click in Watch (sources, Open github.com and similar) open in your browser.
Your feed plan, what the Live Feed plan adds, and your license key. See Plans and pricing for how buying and keys work.
| Part | What it shows |
|---|---|
| Plan | Free, Personal · renews …, or why the key isn’t active on this Mac, with New incident packs (After 24 hours on the free plan, Within minutes with the live feed) and Live: public malicious packages (Usually within the hour, on every plan). “Every plan runs every detection and every fix. The live feed only makes new incidents arrive sooner.” |
| The Live Feed plan | Until it’s on sale: Price, with the founding price, and Availability, which says when it’s coming. Then one row for each thing the plan adds, with what the free plan gets instead and a button that opens it (Feed, Report, Alerts, Retention or Watchlist). With a plan, the header reads Included in your plan. |
| Buy the live feed | Only once it’s on sale: the price, founding price and how many Macs a key covers, with Buy… |
| Licence key | Enter Key…, then a field for your key and Activate; once active, the masked key with Restore and Deactivate This Mac |
| Help | Cloak Watch Help on the free plan. With a plan, Priority help with your support code and Email Subcloak…, which opens an email with your plan and support code and nothing about this Mac. |
| Links | Subscription terms, Refunds and Lost your key? |
Advanced
Section titled “Advanced”Settings › Advanced as it looked in 1.0. In 1.1 the Retention section starts with History and has an Acknowledgements section.
| Setting | What it does |
|---|---|
| History | How long your plan keeps history: 30 days on the free plan, Up to 1 year with the Live Feed plan. On the free plan a Live Feed note says the plan keeps a year of incidents, AI Activity and alerts. |
| Keep fixed incidents | 30 days, 90 days or 1 year (default). Open and dismissed incidents always stay. |
| Keep events and alerts | 7 days, 30 days, 90 days or 1 year (default) |
| Keep AI Activity | 7 days, 30 days (default), 90 days or 1 year: tool names, timings and hosts |
| Keep AI content | 1 day, 3 days, 7 days (default) or 30 days: prompts and other content, only while content is kept (the lock in AI Activity’s status bar) |
| Starting point | When Watch recorded what was already on this Mac. Rebuild Inventory scans again. Start Over From Today… asks first, then makes today the new starting point: unusual things that are here now stop showing as worth a look. Known attacks and anything that needs fixing still show. |
| Command-line tool | Install Command-Line Tool… shows the one Terminal command that puts watchctl on your PATH. |
| Store | Where Watch keeps its inventory and incidents: ~/Library/Application Support/Cloak Watch/watch.sqlite |
| Quarantine | ~/Library/Application Support/Cloak Watch/Quarantine, with Show |
| Third-party notices | Under Acknowledgements: “Repository checks derived from zizmor, secret rules from Gitleaks (both MIT License)”. Show opens the licenses in TextEdit. REPO-1 to REPO-7 are derived from zizmor, and the git-history key rules from Gitleaks. |
| Show demo data | Shows a made-up Mac with problems to fix, for trying Watch or showing it to someone. Nothing on this Mac is changed. A purple Demo badge stays in the toolbar while it’s on. |
Retention is applied when you change it and every hour while Watch runs.
On the free plan, history is kept for at most 30 days: the pickers offer only choices up to 30 days and show what’s kept, while your own choice is remembered and applies again with the Live Feed plan. Forever, a choice in 1.0, now counts as the plan’s limit. For the first 30 days after you update to 1.1, Watch keeps up to a year, so updating doesn’t trim your history on the spot. If a Live Feed plan ends, history older than 30 days is kept for another 30 days, and a line under History says until when; nothing is deleted the moment the plan ends.
| Setting | What it does |
|---|---|
| Version | The version you’re running |
| Updates | Up to date · checked … with Check Now, or the new version with Release Notes and Download |
| Check for updates automatically | On by default: at launch and once a day, a plain download of the current version number. Nothing about this Mac is sent. |
| Help count active installs (anonymous) | Off by default. Update checks then also send the app version and platform, so Subcloak can count installs in use each day. No IP address or ID is kept. |
| Turned off by Subcloak | Only shown when Subcloak has turned a feature off: which one and why. |
Subcloak can turn off the AI gateway, the Network extension or Automatic fixes from the signed feed if one has a problem, so you don’t have to wait for an update. A quiet bar across the main window says so, with Details. Detections and the Inbox are never turned off.
Where Watch keeps its data
Section titled “Where Watch keeps its data”| Path | What |
|---|---|
~/Library/Application Support/Cloak Watch/watch.sqlite |
Inventory, incidents, dismissals and history |
~/Library/Application Support/Cloak Watch/Quarantine/ |
Moved files and originals of edited files |
~/Library/Application Support/Cloak Watch/Feed/ |
The last verified copy of the feed and its signed config |
~/Library/Application Support/Cloak Watch/AI/ |
AI Activity: activity.sqlite, Guard rules and exceptions (guard.json), content settings, gateway routes, the hook script and undo records |
~/Library/Application Support/Cloak Watch/Beyond/ |
What Watch read from GitHub and your domains, in files only you can read |
~/Library/Application Support/Cloak Watch/network-shapes.json |
Network alerts: which programs reached which flagged addresses, for 30 days |
~/Library/Application Support/Cloak Watch/revoke-requests.json |
The times of GitHub revoke requests, to count GitHub’s hourly limit; never the tokens |
| Keychain | Your license key and token, when you have one; the GitHub token, when you connect GitHub; and the key Watch makes secret fingerprints with. All on this Mac only. |
Preferences domain com.subcloak.cloakwatch |
Your settings, exclusions, pause, window and tab choices |