• Reads text from the system clipboard and stores it in ~/Library/Application Support/Taac/history.json, in plain text.
• Requests Accessibility permission for the sole purpose of synthesizing ⌘V in the frontmost app.
• Opens no network connections. No telemetry, no auto-update, no account.

• ~/Library/Application Support/Taac/ is 0700 and history.json is 0600. Atomic writes recreate the file, so the mode is reapplied after every save — a test covers it.
• ~/Library/Logs/Taac/ is 0700, daily files 0600.
• Logs record counts and source app names, never clipboard content, and never the text you type in the search field: looking up part of an IBAN would otherwise write that fragment to a log file.
• The app is signed with the hardened runtime, which blocks unsigned dylib injection and DYLD_* overrides — the easiest way to make another process read what Taac holds.
• No network APIs are linked at all: no URLSession, no sockets.
• No event tap and no global keyboard monitor. The only NSEvent monitor is a local one, active while the shortcut recorder in Settings is open, and it sees only events delivered to Taac itself.
• Accessibility permission is used for exactly one thing: synthesizing ⌘V with CGEvent after the previous app is brought back to the front.

• Clippings flagged org.nspasteboard.ConcealedType (the convention password managers use) are ignored. If an app copies a password without flagging it, that password lands in the history: delete it with ⌘⌫.
• Releases are not notarized, so spctl rejects them and macOS asks you to confirm the first launch. Always take the binary from this repository's Releases, and build from source if in doubt.
• The history is not encrypted. Anything running as your user can read it — true of every clipboard manager, including the ones that do not say so. The 0600 mode keeps out other users of the machine, not your own processes.
• Taac is not sandboxed: a global hotkey plus synthesizing keystrokes into other apps is not expressible under the App Sandbox.

Open an issue whose title starts with [security], without including real data — passwords that ended up in your history, private content, un-redacted screenshots.

If the report concerns a flaw others could exploit, write only "I found a security problem, how should I report it?" and wait for a reply before publishing details.

Realistic timing: this is a personal project, expect an answer within a few days.