Security by reducing the surface.

Current release status

CueStash is in prelaunch. The customer download stays unavailable until the application is Developer ID signed, notarized by Apple, stapled, and verified on a clean supported Mac. We do not substitute the internal QA build for that release.

Local workspace

Stash items, cues, archive state, search data, and preferences are stored on the Mac. The core workflow does not need an account or an AI-provider connection. CueStash captures only when the user asks it to; it does not continuously retain clipboard history.

The working library is sealed with AES-GCM using a random key stored as device-only material in the macOS Keychain. A readable JSON file is created only when the customer explicitly exports the library. FileVault and a protected macOS account remain useful device-level controls.

Permissions

The global capture shortcut works without Accessibility permission. Accessibility is optional and is used only for selected-text capture and automated send-back. If permission is absent, CueStash copies the item and asks the user to paste it manually.

Licensing boundary

Stripe handles payment details. CueStash receives purchase identifiers and the checkout email needed for license delivery. Activation sends a license key, a one-way device identifier, and app-version metadata—not the customer’s stash or cues.

Activation receipts are signed and bound to the device and expiration time. Refunds and unresolved payment disputes revoke the associated license. Recovery responses are generic and throttled to avoid revealing whether an email address is a customer.

Release integrity

Customer disk images and Sparkle appcasts are stored in private release storage. The publisher verifies notarization, Gatekeeper, checksums, Sparkle signatures, and uploaded bytes before it promotes the appcast. The appcast is promoted last so a partially uploaded release is never advertised.

Website and API

The storefront and commerce service use HTTPS, restricted cross-origin access, security headers, strict input validation, opaque rate-limit identifiers, and fail-closed readiness checks. Checkout remains unavailable unless fulfillment, email delivery, and the signed release are all configured.

Reporting

The security reporting mailbox will open with the owned production domain before customer distribution. Until then, no public binary or payment flow is enabled.