bite
Menu

docs · internals

Security & Privacy#

bite is a local-only tool. This page is the short form of the privacy statement and the security policy in the repository; those are the full words.

What bite can access#

When you grant the corresponding macOS permissions, bite can read and modify, on the machine you run it on:

  • Calendar — events in your calendars (EventKit)
  • Reminders — your reminder lists and items (EventKit)
  • Mail — messages, mailboxes and attachments of accounts configured in Apple Mail (Apple Events — ScriptingBridge in the helper, NSAppleScript in the local crawl worker)
  • Notes — your notes in Apple Notes (Apple Events / ScriptingBridge)
  • Contacts — your address book (Contacts framework)
  • Messages — sending iMessage/SMS via Apple Messages, recent chats, and — only with Full Disk Access — your chat history database (~/Library/Messages/chat.db)

The prompt matrix behind each grant is on the permissions page.

Where the data goes#

Nowhere. bite has no server, no account system, no analytics, no telemetry, and no crash reporting. All processing happens in three local processes on your machine (bite, its Swift helper, and the detached bite-crawl worker) and stays in bite's 0700 data dir — the one exception being attachments you explicitly save elsewhere via mail_attachment_save. The only network activity in the entire project is the optional, explicit bite install-helper --prebuilt download (roadmap), which fetches a signed helper binary and involves none of your data.

One caveat you control: bite is an agent tool. Whatever AI agent you connect it to (Claude, Codex, ZCode, OpenCode, …) can read the tool results — so the agent's own privacy policy and data handling apply to anything it does with your data. bite itself adds no network hop; choose agents you trust.

Your control#

  • Every permission is granted through macOS's own TCC prompts and can be reviewed or revoked at any time in System Settings → Privacy & Security. Revoking takes effect immediately.
  • bite doctor's status checks show, without triggering any prompt, which permissions are granted, pending, or denied.
  • Destructive operations always return a preview first and require an explicit confirm: true.
  • The local index, and how to purge it. The LanceDB entity index holds full-text copies of indexed Calendar, Reminders, Mail, Notes, Contacts and Messages data for fast local search. index_forget drops a scope after a preview; bite index wipe removes the entire index. Both act on the LOCAL copy only, and a scoped purge is durable across re-crawls — the details. Body-off rebuilds (--no-body) keep message bodies out of the store entirely.

Reporting a vulnerability#

Please do not open a public issue for a security problem. Use GitHub's private vulnerability reporting, or contact a maintainer directly if that is unavailable. You will get an acknowledgement within a few days and a fix timeline for confirmed issues.

The security-relevant surface:

  • The local bridge protocol between bite and its Swift helper over stdio — e.g. anything that would let another local process impersonate or hijack the helper.
  • Permission boundaries — anything that lets bite access data without the corresponding macOS TCC grant, or act destructively without the confirm: true handshake.
  • Injection through agent input — bite deliberately runs no shell and no dynamic code (the crawl worker's compiled AppleScript is a fixed program with data parameters, not agent-controlled source); report anything that changes that.
  • The toolchain invocation path — swift and codesign are resolved through secure-path rules; report anything that lets an untrusted swift/codesign/xcrun produce or sign the installed helper.
  • The config writers — they edit other applications' MCP config files; report anything that could corrupt or clobber unrelated settings.

Out of scope: vulnerabilities in the macOS permission system itself, in the AI agents bite connects to, or social-engineering of the user into granting permissions. Security fixes land on main; given the pre-1.0 stage, only the latest release receives fixes.

Intended use#

bite is designed to operate on the data of the person running it, on their own machine, with their knowledge. It is not designed for monitoring another person, a device you do not own, or anyone without their consent — such use is unlawful in most jurisdictions and outside the purpose of this project.