What we defend against — and what we don't.
Security products should tell you exactly what they defend against, what the defense is, and — just as loudly — what they do not solve. This page is that document. Every threat class names its source, every mitigation is a shipped feature, and every one ends with the residual risk we do not claim to solve.
One line of orientation first: Copywarden secures your clipboard history — the archive. The live system pasteboard belongs to macOS, and no third-party tool can change who the OS lets read it. That is the boundary of every claim below.
Infostealers
The threat. Commodity malware that harvests credentials, wallets, and files from an infected machine. Infostealers stole more than 1.8 billion credentials in H1 2025 alone — an 800% increase (Flashpoint, 2025). macOS is now a first-class target: Microsoft Threat Intelligence documented DigitStealer, MacSync, and Atomic macOS Stealer harvesting browser credentials and developer secrets from Macs, and described ClickFix campaigns that infect macOS users via commands the victim copies and pastes into Terminal. A plaintext clipboard-history database is exactly the kind of file this malware exfiltrates.
Shipped mitigation. Every clipboard item is encrypted with AES-256-GCM before it reaches disk, with per-item HKDF-SHA256 keys derived from a random 256-bit master key. On Secure-Enclave Macs the master key is stored wrapped by a non-extractable Secure Enclave key; Macs without one use Keychain-only, device-local, unlock-gated storage. An exfiltrated Copywarden store is ciphertext without this Mac and an unlocked session. Detected secrets can additionally auto-expire from history, shrinking the window even for an attacker with full access.
Residual risk we do not claim to solve. Malware running as you, while your session is unlocked, operates inside the trust boundary — it can read the live pasteboard the same way any app historically could, and no encryption at rest changes that. Copywarden is not an antivirus and not DLP. It also cannot stop a ClickFix-style attack: if you paste an attacker's command into Terminal yourself, no clipboard tool can veto the paste.
Screen-share leakage
The threat. Clipboard history surfacing on a shared screen — the popup opening mid-demo, a preview visible during a recorded call. The exposure is structural: 79% of remote-capable U.S. employees now work hybrid or fully remote (Gallup, 2025), which makes screen sharing a daily surface, and a clipboard manager's whole UI is a grid of exactly the content you least want broadcast.
Shipped mitigation. Copywarden detects active screen capture and recording and redacts previews behind a privacy banner while capture is active; revealing an individual item requires Touch ID. Detected secrets are masked in previews at all times, capture or not.
Residual risk we do not claim to solve. This is detection plus redaction — not invisibility. No macOS application can make its windows unseeable to ScreenCaptureKit, and we will never claim otherwise. A capture path we fail to detect is not redacted; a frame captured in the instant before detection may include previews; and anything you actually paste into a visible application is on screen regardless of what Copywarden does.
Agentic access
The threat. AI assistants, Shortcuts automations, and agent frameworks increasingly read application data as "context" — and the clipboard is uniquely valuable context, because it is where credentials transit in plaintext. An agent with clipboard access that dutifully forwards what it read to a model API is an exfiltration path nobody designed on purpose.
Shipped mitigation. Every automation surface — App Intents, Shortcuts, Spotlight, and any future MCP integration — routes through a single chokepoint, AgentAccessGuard, which never serves a detected secret (unconditional redaction, no override exists); honors a kill-switch, so an admin policy or Local-Only mode disables agent access entirely before any read; and writes every access to the tamper-evident, HMAC-chained audit log — which tool, when, how many items, how many secrets withheld, never the content itself.
Residual risk we do not claim to solve. The chokepoint governs Copywarden's surfaces only. An agent granted macOS Accessibility or Screen Recording permissions can read your screen or drive your apps directly, bypassing Copywarden entirely — that boundary belongs to macOS permissions and your own grant decisions. And secret withholding depends on detection: a credential our patterns miss would be served as ordinary content.
Sync leakage
The threat. Clipboard data leaving the device through sync channels — a vendor's cloud holding your history server-side, or OS-level convenience features relaying the pasteboard between devices. Any off-device copy multiplies the surfaces where clipboard data can be breached, subpoenaed, or mishandled.
Shipped mitigation. Copywarden is local-first: everything works with sync off, and nothing leaves your Mac unless you turn it on. There is no Copywarden server holding your clipboard and no telemetry in any tier. Optional end-to-end encrypted iCloud sync carries only opaque AES-256-GCM ciphertext blobs, sealed on-device before upload, into your own private iCloud database — we never hold a decryptable copy, because we never hold the key. Local-Only mode hard-disables every off-device transport for air-gapped, HIPAA, or ITAR-style environments. Both halves are checkable on the wire: with sync off you will see zero outbound connections at all; with sync on, what leaves is ciphertext bound for Apple, not for us.
Residual risk we do not claim to solve. Turning sync on means trusting Apple with metadata — iCloud can see that records exist, how many, and when they changed, even though it cannot read them. Sync also widens recovery risk: lose the key material on every device and the ciphertext is unrecoverable by design, including by us. Separately, Apple's Universal Clipboard operates at the OS layer: content on the live system pasteboard can be relayed to your nearby Apple devices under Apple's rules, not ours — including content Copywarden places there when you paste an item back. We do not claim to control that channel. And macOS Tahoe's own Spotlight clipboard history is an OS feature outside Copywarden, retaining items for up to 7 days if configured — manage it in System Settings; Copywarden cannot manage it for you.
What we never claim
To make the boundary unmistakable, Copywarden does not claim to be, and our marketing may never describe it as: invisible to screen capture; a DLP or antivirus product; able to control the live system pasteboard or Universal Clipboard; "zero-knowledge," "military-grade," "tamper-proof," or "certified" anything; or protection against malware already running with your user session. Where a mitigation is best-effort — detection, redaction, pattern matching — we say best-effort.
And because Copywarden is proprietary, we anchor trust in what you can check rather than in source access: the local-first and telemetry-free claims are verifiable on the wire with any network monitor; every build is Developer ID-signed and notarized by Apple; and this threat model and our single-shot disclosure policy are published in advance. There has been no independent security audit and no bug bounty to date. We would rather say that plainly than promise a date we have not booked.
Sources
Flashpoint, Global Threat Intelligence Index: 2025 Midyear Edition — 1.8B+ credentials stolen by infostealers in H1 2025. Link
Microsoft Security Blog, Infostealers without borders: macOS, Python stealers, and platform abuse, February 2, 2026. Link
Microsoft Security Blog, ClickFix campaign uses fake macOS utilities lures to deliver infostealers, May 6, 2026. Link
Gallup, Hybrid Work in Retreat? Barely., 2025 — 52% hybrid + 27% fully remote among remote-capable U.S. employees. Link
MacRumors, Apple Expands Spotlight Clipboard Settings in macOS Tahoe 26.1, November 4, 2025. Link