Permissions

Permissions

VaultBar asks for very little.

What macOS may show

• First launch warning (not notarized): see Installation → First launch.
• Login Items notification: when Launch at login is on, macOS lists VaultBar under System Settings → General → Login Items (Login Items & Extensions on macOS 15+) and may notify you once that a background item was added. Leave it on for auto-lock to work.
• Notifications: VaultBar asks once to send notifications (locks, a warning before a forced lock, failed locks). Deny it and everything else works the same.
• File access prompts: if a vault image or the Raycast scripts folder is in a protected location (Desktop, Documents, Downloads, external or network volumes), macOS may ask to let VaultBar access that folder. Allow it, or move the vault to a folder such as ~/Vaults.

What it does not need

No Accessibility, no Screen Recording, no Input Monitoring (the panic hotkey uses the system hotkey API, which needs no permission), no Full Disk Access, no Keychain access, no network.

What it can touch

• Your vault images: it creates them (New Vault), checks them (Add Existing), attaches and detaches them. It never deletes them.
• ~/.config/vaultbar/vaults.json.
• A vault's private mount folder, if you set one: created (mode 700) right before unlocking and removed, only when empty, as soon as the vault is locked or ejected.
• Optionally the Raycast scripts folder you choose, where it writes and removes only its own vaultbar-*.sh scripts.