Kolom controls other apps' windows through the macOS Accessibility permission, and can temporarily change your display arrangement. Please report anything that lets another process, website or user abuse that.

Use GitHub private vulnerability reporting. Please do not open a public issue for a vulnerability.

• Moves and resizes windows with the public Accessibility API. Reads window lists; never captures screen contents.
• Asks for Automation (Apple Events) only to open Terminal windows for grids you request. It never sends shell command text.
• Has no telemetry and no listening sockets. Its only network request is a daily HTTPS GET of api.github.com/repos/ckluis/kolom/releases/latest with a Kolom/<version> user agent and no cookies, to say when a newer release exists; nothing about the Mac or its windows is sent. Check for updates automatically in the menu bar menu turns it off. Kolom never downloads or installs anything in the background: updating is a command you run, either pasted or by choosing Update now…, which writes that command to update.command in the folder below and opens it in Terminal, where you watch it run (git pull --ff-only from your own checkout, then a local build).
• Stores layout, recovery records and settings in ~/Library/Application Support/Kolom (mode 0700).

kolomctl and its MCP server talk to Kolom through files in that folder. Read-only commands always work. Commands that move or create windows work only after you choose Allow local agent commands… in the menu bar icon's menu, and stop when you turn them off or quit. The session token only switches the channel on; it is not authentication, because any process running as your user can read it. Treat enabling agent commands as trusting every process in your user session. Requests are refused if they are FIFOs, symlinks, devices or oversized, and each one expires after 30 seconds.

While it is open, the dashboard reads process counters through libproc and the IOKit registry, and runs Apple's /bin/ps as your user (for processes libproc may not read). /usr/bin/nettop (byte counts per process, never contents) runs only during a one-minute network measurement you start from the NETWORK column. Nothing runs while it is closed, and nothing is sent anywhere. Right-clicking a row can quit an app or send SIGTERM or SIGKILL to processes; only your own processes outside macOS's folders are offered, never Kolom's own, and every action asks first. Agents and kolomctl cannot stop processes. The Disk Map scans a disk or folder only when you open it: it reads folder entries and sizes (never file contents) on that disk alone, never opens cloud-only folders (so nothing is downloaded), stops when you close it, and keeps nothing on disk. Since 0.2.9 it can remove what you mark: after a review, to the Trash by default or permanently after a second confirmation, re-checking each path first (still there, not a symlink, not moved). It never offers the whole disk, the mapped folder, your home or anything above it, macOS's own folders, or the folders macOS expects in a home. Agents and kolomctl cannot remove anything. macOS's own privacy prompts and Full Disk Access decide which protected folders it may see.

Ask Kolom (⌥K) takes a request you type and has Apple's on-device model (FoundationModels, macOS 26) turn it into one typed action. resolveAsk checks that action (sizes, a 60-window maximum, known commands only; unknown requests are explained, not run) and Kolom runs it in-process through its existing code. It performs typed actions only, never shell text, and starts no agent session or file-channel request, so it works without the local agent opt-in because it is your own request. Nothing leaves the Mac. Grids it creates are recorded in agent/operations like agent grids, so an agent session you have enabled could undo or redo them.