Repository navigation
Where plaintext can leak
VaultBar keeps the vault itself locked. macOS and your apps can still keep copies or traces of what you opened while it was unlocked. None of these are VaultBar's to clean up, but you should know about them.
| Where | What stays | What to do |
|---|---|---|
| QuickLook thumbnail cache | Previews of vault files you looked at in Finder or a file dialog |
qlmanage -r cache after locking |
| Recent items | File names and paths in apps' Open Recent lists and Finder's Recents (~/Library/Application Support/com.apple.sharedfilelist) |
Clear an app's Open Recent menu; the files stay locked, the names don't |
| Screenshots | Screenshots of vault content go to the Desktop (or your screenshot folder), outside the vault | Save them into the vault, or delete them |
| Clipboard managers | Text and images you copied from vault documents | Exclude VaultBar-mounted paths or clear the history |
| Local AI / LLM apps | Conversations, tool results and logs, often in a folder in your home directory; anything a model read from the vault | Keep those apps' data in the vault, or clear their history |
| Spotlight | Search metadata about the files | Turn indexing off once per vault: sudo mdutil -i off "<mount point>"
|
| Other apps' caches | Autosave or cache folders of editors that don't save next to the document | Check the app's settings |
- The volume's own Trash (
.Trashes) and document versions (.DocumentRevisions-V100) live inside the encrypted image. - Swap is encrypted on Apple silicon, and with FileVault.
- Time Machine backs up the image's encrypted bands, not the decrypted files (as long as you don't add the mounted volume to a backup).
- A private mount folder exists only while the vault is unlocked, so nothing can be written into an empty stand-in folder while it is locked. Hidden from Finder keeps the mount out of the sidebar, the Desktop and other apps' file pickers.
- Read-only mounts can't be written to at all.
