Skip to content
Logo

Security

How Boo protects what you type and paste, and the files it keeps about you.

The ~/.boo folder

Boo keeps its settings, session, command history, notes and recordings in ~/.boo. At every launch Boo makes the folder owner-only (0700) and removes any group or other access.

Saved scrollback in ~/.boo/scrollback/ can hold anything that was on screen. Each file is owner-only (0600) and deleted once it is replayed. Turn off Settings → General → Startup → Restore terminal scrollback to stop saving it; that also deletes what is saved.

Secure Keyboard Entry

Boo → Secure Keyboard Entry stops other processes, such as event taps and keyloggers, from seeing what you type into Boo. The menu item shows a check mark while it is on, and the choice is saved.

Secure input is system-wide while held, so Boo only holds it while Boo is the active app, as Terminal and iTerm2 do.

If another app already holds secure input, Boo says "Secure Keyboard Entry is on, but another app is holding it".

Clipboard confirmations

Boo asks before two kinds of clipboard access. Each opens a sheet with a preview of the text:

  • Risky pastes — Text with line breaks or control characters could run commands as soon as it lands at a prompt. The sheet asks "Paste this text?".
  • Clipboard reads (OSC 52) — A program in the terminal, maybe on a remote host, asks to read your clipboard. The sheet asks "Allow the program to read the clipboard?".

Where the terminal supports it, Remember for this terminal stops the same terminal from asking again.

Programs can always write to the clipboard (OSC 52 write). See Ghostty Integration.

macOS permissions

Settings → Permissions shows the app's signature and Full Disk Access status, with buttons to the matching System Settings panes. See Installation.

Remote Control

The Remote Control server is off until you start it. While it runs, the status bar shows ◉ Remote. It stops itself after 30 minutes without use. It uses plain HTTP, so use it only on a network you trust.

  • Rules — sendText asks before it first types, never types into sudo, ssh or password prompts, and runaway rules are suspended
  • Shell history — the default ignore pattern keeps commands with token=, password= and similar out of ~/.boo/history.db