What Short Leash changes on your computer
Setup makes a few system changes, all listed here, and asks for administrator rights once. Settings › Remove takes each of them back.
- A launchd job, so Short Leash can answer on ports 80 and 443 of 127.0.0.1
- /etc/resolver/test, so .test names reach Short Leash
- Short Leash Local CA in your login keychain, which can only sign .test names
- One name resolution rule, marked Short Leash, so .test names reach Short Leash
- Short Leash Local CA in your trusted root certificates, which can only sign .test names
Removed. Everything Short Leash added is gone.
How Short Leash treats your computer
One administrator prompt, then never again
Setup asks for administrator rights once, to install two plain files on a Mac (a launchd job and /etc/resolver/test) or one name resolution rule on Windows. Trusting Short Leash's certificate authority happens in your own account.
What Short Leash changesNo Short Leash code runs as an administrator
On a Mac, launchd opens ports 80 and 443 and hands them to Short Leash, which runs as you. Nothing Short Leash starts afterwards asks for more.
Privileges and securityOnly on your computer
The proxy, DNS, databases, workers and Mailpit listen on 127.0.0.1, so nothing Short Leash runs is reachable from your network. Sharing connects out to Cloudflare; no ports are opened.
SharingShared sites are checked at the door
A visitor through a share meets your password and IP allowlist before your site sees the request. Webhook deliveries keep the allowlist and must pass their provider's signature check.
WebhooksA certificate authority that can only sign .test
Short Leash's CA is limited to .test names, so even its own key couldn't sign a certificate your browser would accept for any other domain. Site certificates last about 13 months and are renewed before they run out.
HTTPSChecked downloads
Runtimes and services come from each project's own releases and are checked against the checksum it publishes. Short Leash's own builds and updates are checked against its signing key, and a mismatch is refused.
UpdatesSecrets in files only you can read
Cloudflare tokens, the share password, webhook secrets and calls' secret values live in files only your account can read, never in Short Leash's settings.
Ports and filesRemote control is given, never taken
In a Pair call nobody controls your screen until you give control, and moving your own mouse or pressing a key takes it back at once. Keys never go in while a Mac's secure typing is on, as in a password field, or into an administrator window on Windows.
PairLocal AI that listens when asked and asks before it acts
Dictation and meeting notes listen only after you ask, with a lamp on screen, and no audio is ever saved. Chat runs on your computer and asks before every action, showing what it will do.
Local AIThe app collects nothing
No account, no analytics and no tracking in the app. Its update check fetches a static file and sends no version or system details.
Privacy policy
Questions
Does Short Leash need administrator rights?
Once, during setup, to install the files that send .test to Short Leash and let it answer on ports 80 and 443. Short Leash itself always runs as you.
Can other people on my network open my local sites?
No. Everything listens on 127.0.0.1. To let someone in, share the site: they reach it through Cloudflare, with a password if you set one.
Is it safe to trust Short Leash's certificate authority?
It can only sign .test names, so it can't be used to impersonate any real website, even if its key were copied.
How do I undo everything Short Leash set up?
Choose Settings › Remove › Remove system changes…. It undoes exactly what setup did and leaves your projects and databases where they are.
Start free, try Pro for 14 days
Download Short Leash for Mac or Windows. Every Pro feature is on for your first 14 days, with no card and no account.