Ad-hoc signed today · Not yet Apple-notarized

Security, plainly.

Doubleslash installs a macOS event tap so // works in any app. That deserves a direct explanation — not a buried FAQ line.

Why macOS says it can’t verify the developer

This build is ad-hoc signed and not yet notarized. Apple shows “Apple could not verify this app” for that reason. It is not malware theater — it is the unpaid Developer ID / notarization step.

That earlier target date passed, so we removed the promise from current sales copy. Existing purchases remain covered by the published refund policy. We do not claim a new notarization date until Developer ID distribution is ready. We are not asking you to disable Gatekeeper permanently; the current build requires a one-time Right-click → Open.

First open (recommended)

1. Download the DMG → drag Doubleslash to Applications.
2. Right-click Doubleslash → Open → Open.
3. Or: System Settings → Privacy & Security → Open Anyway.

Windows and Linux

Windows and Linux builds are not available yet. There are no public packages or release date. X11/XWayland qualification required. Pure Wayland passive capture is unsupported.

What the event tap does

A CGEvent tap runs on a dedicated background thread (see open-sourced EventTapManager.swift).
Key events pass through. Doubleslash keeps a short sliding buffer only to detect the //command sequence.
When //reminders (etc.) completes with space or return, the trigger is stripped from the host field and a capture HUD opens at the caret.
There is no keystroke log, no cloud upload of typing, and no analytics pixel in the app.

What is never read

Password fields and macOS Secure Input (PrivacyFirewall + Secure Event Input checks).
Apps you put on the exclusion list.
High-entropy secrets patterns (private keys, obvious tokens) are blocked from capture routes.

What leaves your machine

Nothing for //note, //copy, //reminders, //timer, //calc, //obsidian.
Slack — only when you configure a token and explicitly run //slack.
License activation — one HTTPS call to Gumroad’s license verify API.
Updates — a daily HTTPS request for update.json; update downloads are checked against the published SHA-256 before opening. Current v1.2.1 DMG: acb8be70201a2eb74d6ced02444e3db842378cebd2db5e78d965cc3ebf58ac25.
Optional local MCP — loopback 127.0.0.1:9987 only, Keychain token, never public internet.
The landing site may use privacy-friendly Vercel Analytics (page views). The app itself does not phone home for telemetry.

Where data lives on disk

~/Documents/Doubleslash/Quick Capture.md — //note default file
~/Library/Application Support/com.doubleslash.app/ — database, license cache, and optional tokens
Local SQLite capture history (on-device, capped)
Recovery log for failed captures (owner-only permissions)
Your Obsidian / Logseq vaults — only the paths you configure

Audit the capture path yourself

We published the keystroke-touching code:

doubleslash.tafil.app/open-source/capture-path/

EventTapManager.swift — tap install, watchdog, key routing
PrivacyFirewall.swift — secure-field and exclusion gates
TriggerMatching.swift — the //command matcher excerpt

Pro destination drivers are not open-sourced. The claim you can verify today is narrower and stronger: here is every line that decides whether your keystrokes are buffered for a trigger.

Advanced installer

Prefer the DMG. If you use the optional script installer, read it first — it is plain text:

curl -fsSL https://doubleslash.tafil.app/install.sh

It downloads the DMG, copies to /Applications, clears the quarantine flag, and launches the app. Nothing else. Full source: /install.sh.

Report a concern

Email tafil.help@gmail.com. Security issues get priority replies.