Blog · Open source
Read the code: auditing a menu bar app in an afternoon.
VortexFlow needs to see your windows, hear your mouse, and, if you want previews, look at your screen. Those are exactly the permissions a bad program would need. Asking you to trust us is not a serious answer to that. Asking you to read is. Here is the route.
1. Nothing to trust transitively
Open Package.swift. Sparkle is the one third-party dependency, pinned there, and imported only by the Vortexflow executable. Core and its tests stay on Apple frameworks. The Sparkle pin is in the lockfile in the same repository, so you can see which release it is.
2. Network
Search the tree for URLSession. You will find two places in Core.
Core/BrowserFaviconService.swift fetches a site's icon so a browser card can show the site rather than the browser. It requests only the origin root, https://host/, never the page you are on. Redirects that leave that origin are refused by a delegate written for the purpose. The session is ephemeral, so nothing is cached to disk. Private windows are skipped entirely; the rule is a test, not a comment.
Models/WebSearch.swift makes a request only when you choose Open first result for something the switcher could not find. It asks the search engine for the first hit and opens it. That request is the search you just asked for.
There is no analytics SDK and no crash reporter. Sparkle reads https://vortexflow.io/appcast.xml to see if a newer signed build exists, and downloads the enclosure only if you agree. The menu item is Check for Updates. There is no Updates page in Settings.
3. Each permission, and the code that spends it
Core/PermissionsManager.swift is where permissions are asked for. Then follow each one to where it is used:
- Accessibility.
Core/WindowRegistry.swiftreads titles and positions;Core/MRUTracker.swiftkeeps the per-window recency order; raising a window and Move to Display go through the same API. - Input Monitoring.
Core/HIDButtonMonitor.swiftlistens for the one mouse button you chose. That is the whole use of it. - Screen Recording.
Core/ThumbnailService.swift, and only for previews in Strip, Grid and List. Spiral and Circular use icons and never call it. Decline it and the spiral is unchanged. - Automation.
Core/BrowserTabService.swiftasks each browser for its tabs, which is why macOS prompts per browser the first time tab search runs. Decline for a browser and that browser simply has no tab cards.
4. Read the tests
swift test runs about eight hundred of them. They are the most readable specification of the app: the search ranking, the layout geometry, the rule that a private window never fetches an icon, the way a hold turns into a switch and a tap does not. If a claim on this site is not backed by a test, tell us.
5. Skip the download
git clone https://github.com/maheshauti96/VortexFlow.git cd VortexFlow Scripts/build-app.sh --install
A disk image from the site is blocked once, until you click Open Anyway. A build you compile yourself never shows that sheet. If you download instead, the download page lists the SHA-256 of the image.
6. Watch it run
Grant the permissions, open a few sites, and watch with Little Snitch or nettop. You should see an icon request the first time a new site appears in a card, and a request to vortexflow.io/appcast.xml when Sparkle checks for a newer signed build. If you ever see anything else, that is the most important issue you could file.
An afternoon. Probably less. Then you can decide whether to grant the permissions.