Ad-hoc signed today · Notarized builds targeted for 2026-08-23

Security, plainly.

Doubleslash installs a macOS event tap so // works in any app. That deserves a direct explanation — not a buried FAQ line.

Why macOS says it can’t verify the developer

This build is ad-hoc signed and not yet notarized. Apple shows “Apple could not verify this app” for that reason. It is not malware theater — it is the unpaid Developer ID / notarization step.

Notarized builds ship by 2026-08-23, or founding Pro buyers get a full refund. Founding Pro purchases fund the Apple Developer ID and notarization. We are not asking you to disable Gatekeeper permanently; we are asking you to complete a one-time Open Anyway for an indie build, the same way many unsigned Mac utilities ship.

First open (recommended)

1. Download the DMG → drag Doubleslash to Applications.
2. Right-click Doubleslash → Open → Open.
3. Or: System Settings → Privacy & Security → Open Anyway.

What the event tap does

A CGEvent tap runs on a dedicated background thread (see open-sourced EventTapManager.swift).
Key events pass through. Doubleslash keeps a short sliding buffer only to detect the //command sequence.
When //reminders (etc.) completes with space or return, the trigger is stripped from the host field and a capture HUD opens at the caret.
There is no keystroke log, no cloud upload of typing, and no analytics pixel in the app.

What is never read

Password fields and macOS Secure Input (PrivacyFirewall + Secure Event Input checks).
Apps you put on the exclusion list.
High-entropy secrets patterns (private keys, obvious tokens) are blocked from capture routes.

What leaves your machine

Nothing for //note, //copy, //reminders, //timer, //calc, //obsidian.
Slack — only when you configure a token and explicitly run //slack.
License activation — one HTTPS call to Gumroad’s license verify API.
Optional local MCP — loopback 127.0.0.1:9987 only, Keychain token, never public internet.
The landing site may use privacy-friendly Vercel Analytics (page views). The app itself does not phone home for telemetry.

Where data lives on disk

~/Documents/Doubleslash/Quick Capture.md — //note default file
~/Library/Application Support/Doubleslash/ — settings, license cache, optional tokens (ad-hoc builds)
Local SQLite capture history (on-device, capped)
Recovery log for failed captures (owner-only permissions)
Your Obsidian / Logseq vaults — only the paths you configure

Audit the capture path yourself

We published the keystroke-touching code:

doubleslash.tafil.app/open-source/capture-path/

EventTapManager.swift — tap install, watchdog, key routing
PrivacyFirewall.swift — secure-field and exclusion gates
TriggerMatching.swift — the //command matcher excerpt

Pro destination drivers are not open-sourced. The claim you can verify today is narrower and stronger: here is every line that decides whether your keystrokes are buffered for a trigger.

Advanced installer

Prefer the DMG. If you use the optional script installer, read it first — it is plain text:

curl -fsSL https://doubleslash.tafil.app/install.sh

It downloads the DMG, copies to /Applications, clears the quarantine flag, and launches the app. Nothing else. Full source: /install.sh.

Report a concern

Email tafil.help@gmail.com. Security issues get priority replies.