apple-privacy-security

name	apple-privacy-security
description	Design or audit macOS permissions, privacy metadata, entitlements, sandbox access, Keychain use, sensitive logging, network/file boundaries, and secure defaults.
license	MIT
metadata	{"version":"2.0","provenance":"Independently adapted from tqbf/swiftui-app capability notes, twostraws hygiene guidance, and this template's sandbox policy; see NOTICE.md."}

macOS privacy and security

Read references/privacy-and-permissions.md when adding a capability, entitlement, permission prompt, credential, network client, file access, analytics, diagnostics, clipboard, camera, location, contacts, or release privacy declaration.

The starter enables the application sandbox plus user-selected read/write file access for its import/export example. Remove that entitlement if the derived product removes the file workflow, and add other capabilities only for behaviour that exists.

Workflow

1. Minimise data collection and capability scope before implementation.
2. Record the data, purpose, retention, sharing, deletion, and user control.
3. Add only the required plist usage descriptions, sandbox entitlements, privacy-manifest reasons, and distribution declarations.
4. Request permission in context and design denial, restriction, later grant/revocation, and Settings-change behaviour.
5. Store credentials through an injected Keychain service; keep secrets out of source, preferences, logs, and crash metadata.
6. Keep ATS and platform trust validation enabled; document any narrower trust requirement and its rotation/failure plan.