Skip to content
ATARUS. OFFENSIVE SECURITY

Products

Exposure Check

A Mac app that will show what an infostealer would find on your Mac, by checking where sensitive files exist without opening them.

In development Being built. Nothing has been released yet.

The problem

Mac infostealers such as Atomic Stealer go after browser password and cookie stores, crypto wallets, shell history and the configuration files in your home folder where SSH keys and cloud credentials live. Most people do not know how many of those sit on their own laptop.

Breach lookups tell you after your data has been stolen. This is meant for before: a list of what a stolen copy of your home folder would hand over, while you can still remove or move it.

What it will do

  • List which of those stores and files exist on your Mac, with where each one is, its size and when it last changed.
  • Say for each item what it would mean if a stealer took it, and what you can do about it.
  • Say what it checked and what it did not, including anything it could not reach without Full Disk Access. Granting that access will be an optional second step, not a requirement.
  • Run entirely on your Mac, with no account.

What it will never do

  • Open, read or decrypt any store it finds. It will not read cookie or password entries and will not touch the keychain item browsers use to encrypt them.
  • Make a network connection. The first version will not even check for updates; notices will be posted on this page instead.
  • Send your report anywhere.
  • Tell you your Mac is safe or clean. It will say what it found and what it did not check.

Reviews

Every product passes three reviews: an idea review before design, a design review before code, and a release review before it is listed here. A product that fails one is stopped, and the reason is recorded.

  • Idea

    Passed

    A market review and a security review kept it as a free, open-source tool.

  • Design

    Passed with conditions

    The security review allowed a first version only if it checks presence alone, makes no network connections and runs in the app sandbox.

  • Release

    Not yet held

    A test run of the built app and a security review of it, before it is listed here.

What this page will carry at release

  • The version number and its release notes.
  • A summary of the release review: what was tested, what was found and what was fixed.
  • A demo recorded on a test Mac with planted sample files, never a real person's Mac.
  • The app's entitlements, which should show no network access.
  • A network table generated from the code.
  • The hash that ties the source tag to the binary, published in two places.
  • The fingerprints of the signing keys.
  • The commands to check all of the above yourself.

The rules it is built under

The same rules apply to every product we build. The security page covers them in full. The products page lists the others.

Auditor by default
Every tool observes, inventories and reports. Read-only is the default and needs no confirmation.
Active only on targets you placed in scope
Anything that probes a live system runs only against a target inside a scope you set, after a confirmation that software, including an AI model, cannot give on your behalf.
Never a false clean
Results say what was checked and what was not. No tool will tell you something is safe.
Threat model before code
Each module gets a written threat model at its design review, before any code.
Fuzzing on every parser
Anything that reads untrusted input gets a fuzz harness and limits on size, depth and paths.
Signed and reproducible builds
Releases will be signed, with separate keys for separate jobs, and built so that anyone can match the published source to the published binary.
Outside review once there is revenue
A security firm checking its own work is not an independent check, so an outside firm will review the platform once it earns.

Follow: release notes will go out in the research feed as posts of kind Tools, and our open-source code is on GitHub.