What we defend against — and what we don't.
Security products should tell you exactly what they defend against, what the defense is, and — just as loudly — what they do not solve. This page is that document. Every threat class names its source, every mitigation is a shipped feature, and every one ends with the residual risk we do not claim to solve.
One line of orientation first: Copywarden secures your clipboard history — the archive. The live system pasteboard belongs to macOS, and no third-party tool can change who the OS lets read it. That is the boundary of every claim below.
Infostealers
The threat. Commodity malware that harvests credentials, wallets, and files from an infected machine. Infostealers stole more than 1.8 billion credentials in H1 2025 alone — an 800% increase (Flashpoint, 2025). macOS is now a first-class target: Microsoft Threat Intelligence documented DigitStealer, MacSync, and Atomic macOS Stealer harvesting browser credentials and developer secrets from Macs, and described ClickFix campaigns that infect macOS users via commands the victim copies and pastes into Terminal. A plaintext clipboard-history database is exactly the kind of file this malware exfiltrates.
Shipped mitigation. Every clipboard item is encrypted with AES-256-GCM before it reaches disk, with per-item HKDF-SHA256 keys derived from a random 256-bit master key. On Secure-Enclave Macs the master key is stored wrapped by a non-extractable Secure Enclave key; Macs without one keep it in the Mac's data-protection keychain, device-local and unlock-gated. Either way, an exfiltrated Copywarden store is ciphertext without this Mac and an unlocked session. The one exception: if macOS refuses the data-protection keychain, the key is kept in the login keychain, where those limits don't apply, and Settings → Security → Key storage says so. Detected secrets can additionally auto-expire from history, shrinking the window even for an attacker with full access.
Residual risk we do not claim to solve. Malware running as you, while your session is unlocked, operates inside the trust boundary — it can read the live pasteboard the same way any app historically could, and no encryption at rest changes that. Copywarden is not an antivirus and not DLP. It also cannot stop a ClickFix-style attack: if you paste an attacker's command into Terminal yourself, no clipboard tool can veto the paste.
Screen-share leakage
The threat. Clipboard history surfacing on a shared screen — the popup opening mid-demo, a preview visible during a recorded call. The exposure is structural: 79% of remote-capable U.S. employees now work hybrid or fully remote (Gallup, 2025), which makes screen sharing a daily surface, and a clipboard manager's whole UI is a grid of exactly the content you least want broadcast.
Shipped mitigation. Copywarden detects active screen capture and recording and redacts previews behind a privacy banner while capture is active. Detected secrets are masked in previews at all times, capture or not — revealing one is a deliberate per-item action.
Residual risk we do not claim to solve. This is detection plus redaction — not invisibility. No macOS application can make its windows unseeable to ScreenCaptureKit, and we will never claim otherwise. A capture path we fail to detect is not redacted; a frame captured in the instant before detection may include previews; and anything you actually paste into a visible application is on screen regardless of what Copywarden does.
Agentic access
The threat. AI assistants, Shortcuts automations, and agent frameworks increasingly read application data as "context" — and the clipboard is uniquely valuable context, because it is where credentials transit in plaintext. An agent with clipboard access that dutifully forwards what it read to a model API is an exfiltration path nobody designed on purpose.
Shipped mitigation. Every automation surface — App Intents, Shortcuts, Spotlight, and any future MCP integration — routes through a single chokepoint, AgentAccessGuard, which never serves a detected secret (unconditional redaction, no override exists); honors a kill-switch, so an admin policy or the Allow Shortcuts and AI agents switch disables agent access entirely before any read; and writes every access to the tamper-evident, HMAC-chained audit log — which tool, when, how many items, how many secrets withheld, never the content itself.
Residual risk we do not claim to solve. The chokepoint governs Copywarden's surfaces only. An agent granted macOS Accessibility or Screen Recording permissions can read your screen or drive your apps directly, bypassing Copywarden entirely — that boundary belongs to macOS permissions and your own grant decisions. And secret withholding depends on detection: a credential our patterns miss would be served as ordinary content.
Sync leakage
The threat. Clipboard data leaving the device through sync channels — a vendor's cloud holding your history server-side, or OS-level convenience features relaying the pasteboard between devices. Any off-device copy multiplies the surfaces where clipboard data can be breached, subpoenaed, or mishandled.
Shipped mitigation. Copywarden is local-first: everything works with sync off, and no clipboard data leaves your Mac unless you turn it on. With sync off no Copywarden server holds your clipboard, and usage data and crash reports — never clipboard content — are sent only if you opt in. Optional end-to-end encrypted sync (beta, off by default) carries only opaque AES-256-GCM ciphertext blobs, sealed on-device before upload — we never hold a decryptable copy, because we can't read the key. Both halves are checkable on the wire: with sync off, no clipboard data leaves your Mac — what you will see is the signed update check against copywarden.com, unless you turn automatic update checks off, and you can watch that one too. With sync on, what leaves is ciphertext only you can read: to Copywarden's servers by default, or to iCloud if you pick that backend.
Residual risk we do not claim to solve. Turning sync on means trusting your sync provider with metadata — whoever holds the ciphertext can see that records exist, how many, and when they changed, even though they cannot read them. Sync also widens recovery risk, by design. With sync through our servers, if none of your Macs and no iCloud Keychain of yours still has your account key, and you have neither your master password nor your Emergency Kit, the ciphertext can't be decrypted by anyone, including us. With iCloud sync, the same is true once the sync key is gone from your Macs and your iCloud Keychain. Separately, Apple's Universal Clipboard operates at the OS layer: content on the live system pasteboard can be relayed to your nearby Apple devices under Apple's rules, not ours — including content Copywarden places there when you paste an item back. We do not claim to control that channel. And macOS Tahoe's own Spotlight clipboard history is an OS feature outside Copywarden, retaining items for up to 7 days if configured — manage it in System Settings; Copywarden cannot manage it for you.
The account key's iCloud Keychain backup
What travels. A Copywarden Account with no master password — one that signs in with Apple, GitHub or Google — keeps a copy of its account key in your iCloud Keychain by default, so a Mac signed in to the same Apple Account opens the account without the Emergency Kit. Apple end-to-end encrypts iCloud Keychain, so Apple can't read the copy, and it never reaches our servers. An account with a master password never uses it. Turning it off in Settings › Account & Sync deletes the copy.
Someone with access to your iCloud Keychain. A device trusted on your Apple Account can read this key, as it can read any password saved there: the backup relies on that trust. It can delete the copy, and a new Mac then needs the Emergency Kit. It cannot get a Mac to use a different key: a Mac uses a copy only if it matches the fingerprint of the key the account was created with, and refuses any other. It cannot turn the backup back on unless it already read the key while the backup was on: your account's setting is kept on our server, a Mac reads it before it uploads, and turning it back on takes proof that the Mac asking holds the account key, which our server checks against that fingerprint. Turning the backup off, or adding a master password, deletes the copy and stops new ones, but it doesn't take back a key someone already read, because Copywarden can't change an account's key (reasoned from the design, not measured).
Residual risk we do not claim to solve. Each of these is reasoned from the design, not measured. The first key wins. An account's key fingerprint is written once: for an account that has none yet, the first session to write one sets the key every Mac checks against. Only a fingerprint written when the account was created is trusted for the backup, so an older account that gained one later is never backed up to or opened from iCloud Keychain. An interrupted setup stays open. If setting up a new account is interrupted after the account exists but before its vault is set up, the next session to set it up is trusted as the account's creator, however much later that is, and signing in with the provider is enough to get such a session. A master password saved in iCloud Keychain. If you save your master password there, whoever can read your iCloud Keychain can use it to sign in and unwrap your account key, with or without this backup. Accounts with a master password don't use the backup, so for them, iCloud Keychain holds nothing that opens the account unless you save the password or your Recovery Key there. Off can win a race. If one Mac turns the backup off while it can't reach our server and another turns it back on, the off is sent again later and can win. That fails toward off: the backup stays off until someone turns it on again.
What we never claim
To make the boundary unmistakable, Copywarden does not claim to be, and our marketing may never describe it as: invisible to screen capture; a DLP or antivirus product; able to control the live system pasteboard or Universal Clipboard; "zero-knowledge," "military-grade," "tamper-proof," or "certified" anything; or protection against malware already running with your user session. Where a mitigation is best-effort — detection, redaction, pattern matching — we say best-effort.
And because Copywarden is proprietary, we anchor trust in what you can check rather than in source access: the local-first and opt-in claims are verifiable on the wire with any network monitor; every build is Developer ID-signed and notarized by Apple; and this threat model and our single-shot disclosure policy are published in advance. There has been no independent security audit and no bug bounty to date. We would rather say that plainly than promise a date we have not booked.
Sources
Flashpoint, Global Threat Intelligence Index: 2025 Midyear Edition — 1.8B+ credentials stolen by infostealers in H1 2025. Link
Microsoft Security Blog, Infostealers without borders: macOS, Python stealers, and platform abuse, February 2, 2026. Link
Microsoft Security Blog, ClickFix campaign uses fake macOS utilities lures to deliver infostealers, May 6, 2026. Link
Gallup, Hybrid Work in Retreat? Barely., 2025 — 52% hybrid + 27% fully remote among remote-capable U.S. employees. Link
MacRumors, Apple Expands Spotlight Clipboard Settings in macOS Tahoe 26.1, November 4, 2025. Link
Apple Support, iCloud data security overview — Passwords and Keychain are end-to-end encrypted, with the keys on trusted devices. Link