Sweep for Mac

Download Sweep-for-Mac-1.0.1.dmg (macOS 14 or later, Apple Silicon and Intel)

Open the DMG, drag the app to Applications, open it. The first time, macOS says the app is from an unidentified developer: right-click the app, choose Open, then Open again. That is once.

Sweep finds the personal data already sitting in your files. Card numbers, bank details, identity numbers, private keys, API tokens, passwords saved as ordinary text, and the browser password export you made and forgot. It tells you what is where, and stops there.

It never uploads a file, never changes one, and never writes down the secret it found. A finding keeps its kind, its place, and the last four characters, so the report itself is safe to keep and safe to send to someone.

It opens on one sentence: how many things are worth knowing about, how many of those would matter if someone else opened your Mac, and what to do about the worst one. Then the list, worst first.

What it looks for

• Payment cards, checked with the Luhn formula and named by brand, so a Visa is a Visa and an order number is not a card.
• Bank details: IBANs checked against their own mod-97 checksum, and US routing numbers checked against theirs.
• Identity numbers: US Social Security numbers, ruling out the ranges that were never issued; UK National Insurance numbers; Canadian Social Insurance numbers, checksummed.
• Private keys: RSA, OpenSSH, EC, DSA, PGP and PuTTY, by the block written into the file and by the names keys usually have.
• API keys and tokens that announce themselves: Amazon, GitHub, Stripe, Slack, Google, OpenAI, Anthropic, SendGrid, Twilio, npm, Shopify, and JSON web tokens.
• Passwords in plain text: password = … in config files, .env files, notes. Placeholders like changeme and ${DB_PASS} are not reported.
• Exported password lists: the CSV a browser or password manager writes, counted by how many logins are in it. This is usually the worst thing on any Mac, so it is always first.
• Tax documents, by what they say and what they are called.
• Text inside screenshots: the screenshot of a password, the photograph of a card, the scan of a passport. macOS reads the text on the device, so this costs nothing and nothing leaves the Mac. Screenshots are read by default because that is where these things end up; Settings reads every photograph too, which takes several times longer.

How sure it is, and what it does about being unsure

A scanner that cries wolf is worse than no scanner, so confidence is the centre of the design rather than a label bolted on.

Every finding says Certain, Likely or Possible. Certain is reserved for things that carry their own checksum or cannot be anything else: a private key block, an IBAN that passes mod-97, a card that passes Luhn on a line that says card. Likely is a strong match with nothing arguing either way. Possible means the shape is right and nothing confirms it.

Only Certain and Likely are counted. The headline number, the sidebar counts and the command line's exit code all ignore Possible matches. They are collected under "Probably fine", folded away, and listed by sweepmac scan --all. A maybe that shouts is what makes these tools useless.

Three rules do most of the work of staying quiet:

• The line gets a vote. A Luhn-passing sixteen-digit number is a card on a line that says card, and only a possible match on a line that says order, tracking or IMEI. A nine-digit shape next to the word phone, invoice or ref is not reported at all.
• Code is not a password. password = req.body.password, secret = config.get("secret"), password: string and {{ .Values.password }} are references, not secrets, and are dropped. A value that could be either a passphrase or a variable name is a Possible, never an alarm.
• Published examples are known. The card numbers the payment networks publish for testing, and the API keys companies print in their own documentation, are recognised as documentation.

A fixture of twelve realistic lines of source code and paperwork used to produce eleven findings, of which one was real. It now produces that one, plus two honest Possibles.

If something still bothers you, the ✕ on a finding offers to stop mentioning that one, everything in that file, or everything in that folder. sweepmac ignore <path> does the same. Nothing is forgotten silently: Settings shows how many are silenced and can bring them all back.

The honest limits

• It reads what you can read. Folders macOS keeps private stay private unless you give the app Full Disk Access in System Settings. When that happens it says how many folders stayed shut and offers the button that opens the right settings pane.
• Test fixtures are left out by default, because their job is to hold secrets that are not real. The count is shown, and Settings includes them.
• A scan of a full home folder takes about half a minute: the files are listed first, then read on every core at once. Stop stops it.
• It reads text: plain files, PDFs, Word, Excel, PowerPoint, RTF and HTML. Pages, Numbers and Keynote documents are listed by name but not read inside. Images are never opened, so a photograph of a card is not found.
• Pattern matching finds things that look right and misses things written unusually. It can flag a number that only looks like a card. That is why it says how sure it is instead of pretending.
• It never deletes, moves, edits or encrypts anything. What to do about a finding is your decision; Reveal opens the folder in the Finder and that is as far as it goes.

The drive in the drawer, and the repository's past

Plug in an external disk or a Time Machine backup and Sweep offers to read it, because old backups are where the tax return from three years ago and the key you stopped using actually live. A backup is named as one, since reading years of files takes a while.

Turn on What git repositories used to contain and it asks git what a repository held before. A key you committed and then deleted is still there, and in every clone anyone made, and deleting the file did nothing. Sweep reads the history and changes nothing: revoking the key at the source is the only step that helps, and it says so.

It keeps watching

Sweep watches the folders it scans. The moment a browser writes its password export, or a private key or an API token lands in Downloads, it tells you once, with the one thing to do about it. Only things sure enough to matter interrupt you: a possible match never does, and neither does a tax document. The file is read where it lies and nothing is changed. Settings turns it off, and says so if macOS has notifications turned off for Sweep, because then it has no way to tell you.

Where you start it from

Right-click any folder in Finder and choose Sweep This Folder. Drop a folder on the window, or on the Dock icon. Or open the app and press Scan. The scan says which folder it looked in, so a one-off never gets confused with the usual three.

A report you can keep

Save Report writes the whole scan as Markdown or CSV: what was found, where, how sure it was, and what to do about each kind. Copy Report puts the same thing on the clipboard. Neither contains a password, a card number or a key, because the findings never held one, so the report is safe to keep in a shared folder or paste into a message to whoever asks.

The command line

sweepmac scan ~/Downloads --json     # exit 1 when something is found
sweepmac report                      # the last scan again, reading nothing
sweepmac status                      # what it would look at, and when it last did
sweepmac ignore ~/Downloads/known.csv
sweepmac watch ~/Downloads --minutes 30   # what the watcher would say about what just landed
sweepmac scan ~/code --history            # also what those repositories used to contain

The JSON carries the same redacted findings the window shows, with the host, user, time and version around them, so a saved report still means something later. Exit codes: 0 nothing found, 1 something found, 2 a problem, 64 a usage mistake.

Where it keeps things

~/Library/Application Support/Sweep for Mac holds the last scan and the list of findings you told it to stop mentioning. Neither file contains a secret. There is no server, no account, no analytics, and the app makes exactly one network request: a daily check of this repository's releases page for a newer version, which Settings can turn off.

Building it

swift build && .build/debug/SweepMac selftest
./build-app.sh --install

MIT licensed. Signed by its author rather than by a paid Apple Developer ID, which is why macOS asks the first time.