Help & Documentation
How RedactBar Works
RedactBar runs as a lightweight native menu bar app (LSUIElement). It monitors the local leak vectors on your Mac:
- Clipboard: Polls macOS
NSPasteboard.changeCount. When new text is copied, RedactBar passes it through a local Swift regex catalog and Shannon entropy heuristic. If a credential matches, you receive a quiet notification. - Shell History: Scans
~/.zsh_history,~/.bash_history, and fish history files for inline tokens, API keys, and passwords. - .env Files: Recursively crawls your project directories, identifies un-gitignored credential files, and detects duplicate production secrets shared across microservices.
Permissions Explained
RedactBar requires minimal permissions, and all sensitive permissions are strictly opt-in:
- Notifications (Recommended): Allows RedactBar to show interactive banners with "Clear Clipboard" and "Copy Masked" actions when a secret is copied.
- Accessibility (Optional): Only needed if you turn on Paste Guard to intercept Cmd+V when pasting secrets into web browsers or chat clients. The core clipboard and file features work without Accessibility.
- Files & Folders: RedactBar reads user-selected directories to audit
.envfiles. It never accesses files outside of your configured scan roots.
Installation via Homebrew
brew tap suresk/tap
brew install --cask redactbar
Handling False Positives
If RedactBar flags a benign hash, mock token, or public identifier, click "Ignore" on the notification or "Allowlist" in the dashboard. RedactBar will remember the string locally and never alert on it again.
Uninstalling
To completely remove RedactBar and its local settings:
# Quit RedactBar, then remove the application:
rm -rf /Applications/RedactBar.app
# Remove local preferences:
rm -rf ~/Library/Preferences/com.suresk.redactbar.plist
rm -rf ~/Library/Application\ Support/RedactBar
If you installed via Homebrew, run brew uninstall --zap redactbar.
Contact & Support
Have questions or feedback? Email support@getredactbar.com.