Security

For a security team reviewing Wayfinder. Last updated 31 October 2026

Wayfinder holds the way into your servers, so it adds as little as it can to what is already there. It logs in with the OpenSSH that comes with macOS, keeps secrets in the Keychain, needs no account, and sends nothing about you or your servers to VersaMinds. This page says where each thing is kept and what Wayfinder does by itself, so you can check it.

Where everything is kept

• Passwords and secrets are kept in the login Keychain of each Mac, one item per account under live.versaminds.Wayfinder: SSH and sudo passwords and key passphrases you choose to save, FTP passwords, S3 secret keys and the assistant's API key. They are never written to Wayfinder's files and are not set to sync through iCloud Keychain. Settings › Connections lists the saved ones and removes them.
• Hosts you add in Wayfinder are an ordinary ssh_config file, hosts.conf, in ~/Library/Application Support/Wayfinder/Library. Beside it, library.json holds your groups, snippets, workspaces, tunnels, storage connections (without their secrets), Telnet, serial, Remote Desktop and VNC connections, hosts' descriptions and notes, favourite folders, and the older algorithms you allowed for a host.
• ssh reads them through an include file. At launch Wayfinder writes a small config, ~/.ssh/wayfinder-cm/ssh_config, that includes Wayfinder's hosts, then your ~/.ssh/config, then the system's. Every connection is made with it. Older algorithms you allowed for one host go in legacy_ssh_config beside it, which ssh reads first. When the path to your home folder is too long for a socket, or has a space in it, the folder is /tmp/wayfinder- and your user number instead, still readable only by you.
• Your own ~/.ssh/config is read and left as you wrote it. Wayfinder changes it only if you choose Use These Hosts in Every Terminal in Settings › Connections, and then adds one Include line at the top, with a comment saying how to remove it, and a link, ~/.ssh/wayfinder.conf, to Wayfinder's hosts.conf.
• iCloud Drive, only when you choose it. With Keep them in iCloud Drive turned on, the library folder moves to a Wayfinder folder in your own iCloud Drive, so your other Macs see the same hosts and groups. Passwords stay in each Mac's Keychain, and ~/.ssh/config stays on this Mac. VersaMinds cannot read any of it.
• Private keys stay where they are: in ~/.ssh, in your SSH agent, or on a security key. Wayfinder never copies one. Set Up Key Login makes a new key with the Mac's own ssh-keygen and puts only its public half on the host.
• Shared connections are OpenSSH control sockets in ~/.ssh/wayfinder-cm, a folder only you can open. One per host; it closes a minute after the host's last tab by default.
• The activity log is ~/Library/Application Support/Wayfinder/activity.jsonl, readable only by you. It rolls over at 10 MB and keeps one older file.
• Terminal transcripts are off unless you turn them on. Then they go to ~/Library/Logs/Wayfinder/Transcripts, readable only by you, and are deleted after 90 days unless you choose otherwise.
• Files you edit from a server are working copies in ~/Library/Application Support/Wayfinder/Edits, removed once editing stops with every save uploaded. Copies made for a drag, a drop or Quick Look are in the temporary folder and removed after a day; a Remote Desktop connection's .rdp file is there too.
• Settings, the licence and the trial's first day are in Wayfinder's preferences on the Mac.

OpenSSH does the SSH

Wayfinder does not implement SSH. Every terminal, file pane, monitor and tunnel to a host runs /usr/bin/ssh, the OpenSSH that comes with macOS and that Apple keeps up to date. Your ssh_config, agent, keys, jump hosts, known_hosts, security keys and Kerberos apply exactly as they do in Terminal.

• Host keys are checked by ssh against your known_hosts. When a host's key has changed, ssh refuses the connection. Wayfinder offers to remove the old key only after your own files confirm the warning is about this host, so text a server prints cannot trigger the offer.
• Passwords ssh asks for come to Wayfinder through its own small helper, wayfinder-askpass, over a socket in that private folder. Wayfinder answers only after the kernel confirms the caller is that helper, started by the ssh of one of its own tabs; a token in the request is not enough on its own.
• Older algorithms, which some switches and appliances still need, are never allowed for every host. Wayfinder allows them for one host, when you agree, after checking with a separate probe that the server really offers nothing newer.
• Files over SFTP use the host's connection. A file name sent by a server cannot place a file outside the folder you chose, and downloads are marked as coming from the internet, so Gatekeeper checks an app or a script before it opens.
• Everything else connects only where you point it. S3 and FTP go to the address you entered. SMB, NFS and WebDAV shares are mounted by macOS. Clusters are reached with your own kubectl or oc and your kubeconfig.

The app

• Signed and notarised. Each release is signed with VersaMinds' Developer ID under the hardened runtime, with no exceptions to it, and notarised by Apple.
• Not sandboxed, because it runs your own ssh, kubectl and editor with your own configuration, which a sandboxed app cannot do.
• What it connects to by itself: the hosts, storage and clusters you open, the model you chose for the assistant when you ask it something, and the update check. Plain HTTP is allowed, because model servers and object stores on a company network often use it, but only to addresses you entered.

Licences are checked offline

A licence is a short text that VersaMinds signs with an Ed25519 key. Wayfinder checks the signature with the public key built into the app. There is no account, no activation and no licence server, so it works on a Mac with no internet access. The 7-day trial is counted on the Mac, from the first launch.

Updates

• Signed twice. Updates come through Sparkle from wayfinder.versaminds.live, over HTTPS only. Each one is signed with VersaMinds' update key, and Wayfinder installs it only if that signature matches the key built into the app. The app inside is signed and notarised like the download.
• What the check shares: what any web request does, such as your IP address, and which version of Wayfinder you have. Sparkle's system profile, which would add your Mac's model and macOS version, is not turned on.
• Under your control. Wayfinder checks about once a day. Turn that off in Settings › General and use Wayfinder › Check for Updates… when it suits you.
• Never past your licence. An update your licence does not cover is not offered. A licence covers every update released in the year after it was bought, and those versions keep working with it for good.

No telemetry

• No analytics, no usage statistics and no account.
• Crash reports stay on the Mac. macOS writes them. At the next launch Wayfinder offers to show the newest one, and Help › Show Crash Reports finds them later. Nothing is sent: to share one, attach it to a mail.
• Help › Contact Support opens a new mail in your own mail app with the Wayfinder version, the macOS version, the kind of Mac and the licence number filled in, for you to read and send.
• What macOS itself shares with Apple follows your choice in System Settings › Privacy & Security › Analytics & Improvements.

The assistant

Ask about a host is off until you choose a model in Settings › Assistant: your own Anthropic or OpenAI key, a gateway such as LiteLLM, or Ollama on your own network. It sends nothing until you ask a question, and then only to that model.

Wayfinder checks every command the model asks for. It uses an allow-list, not a deny-list: a command runs by itself only when every program in it is one known to read, used in a way that reads, such as ls, df, ps, journalctl, systemctl status or kubectl get. These wait for your Run, with the reason shown:

• anything that changes the host, such as restarting, editing, deleting or installing;
• anything run as another user, through sudo, su or the like;
• anything it cannot follow: a command inside another, a background job, a here-document, a shell or an interpreter, a program it does not know;
• writing to a file, printing the environment, or reading a file that looks like it holds a secret, such as a private key, an .env file or a kubeconfig;
• anything that reaches another host, such as ping, dig or curl to another address, since it could carry what was read.

A second check of its own knows what is hard to take back: deleting files, stopping processes, restarting or stopping services or the host, installing or removing software, and changing the firewall, the network, accounts, disks, containers or a cluster, or writing over a file. Such a command never runs by itself, even if the first check were to let it through. Its card turns red and its Run asks once more, with the command shown in full. Nothing changes on a host unless you run it.

Before the assistant first looks at a host, it asks you to accept that it is AI and can be wrong, that you are responsible for the commands you run or approve, and that you use it at your own risk. Settings › Assistant shows when you accepted, and withdraws it.

Each command runs for at most 20 seconds, and the model sees at most 8,000 characters of its output. Before output or the terminal's screen goes to the model, what looks like a password, token or private key is replaced with [redacted]. You still see everything. Settings › Assistant lists everything the model is sent; your saved passwords are never part of it. Text you choose in a terminal and ask about goes with the question, with secrets removed the same way, and while a debug session is recorded a question also carries what was typed and run in every tab since it started, which you can untick. To approve every command yourself, turn off Run commands that only read without asking.

The activity log

Window › Activity Log (⌥⌘L) lists every command Wayfinder ran on a host without you typing it, with its time, exit code and who asked: the monitor's script, file operations, tunnels (with the cat that keeps a host's connection up while its tunnels are open) and the assistant's commands, each marked. What you type in a terminal is yours and is not logged. The monitor's script is shown in full in Settings › Files & Monitor; it only reads, writes no files and installs nothing.

Programs in the terminal

A program on a server can send a terminal more than text. Wayfinder decides what it may do.

• The clipboard. Programs such as tmux and vim can ask to copy (OSC 52). This is off by default. When you turn on Let programs in the terminal copy to the clipboard (Settings › General, under Terminal), only the tab in front may copy, and only while Wayfinder is the active app, so a server in a background tab cannot change what you copied.
• Links a program marks up (OSC 8) can show one address and lead to another. ⌘-click opens one only for http, https and mailto, and only after a question that shows the full address.
• Addresses printed as text open with ⌘-click, since you see what you click: web and mail addresses and the ssh, sftp, ftp, ftps, smb and vnc schemes. Never a file on your Mac.
• ssh://, sftp:// and telnet:// links from a browser, a wiki or a CMDB always ask before connecting, naming the host and saying that Wayfinder will log in with your keys and settings. A link whose parts could be read as an ssh option is ignored.
• Editing a remote file opens it in your code editor, never in the file type's own app, which for a script could be Terminal running it on your Mac.

Reading the code

A security team that wants to read the source before approving Wayfinder can have access under an NDA, for a team of twenty or more. Write to sales@versaminds.live.

Reporting a vulnerability

If you find a security problem in Wayfinder or this website, write to support@versaminds.live with Security in the subject. Say what you found, which version you have (Wayfinder › About Wayfinder), and how to reproduce it. Please give us time to ship a fix before you publish.