KeyRotate security

Last reviewed 31 October 2026

KeyRotate is an API key manager for Mac, published by Enfour, Inc. This page sets out how it protects your keys, what it depends on, how to report a security problem and how we tell you about one. It describes the app as it is today and claims no outside certification or audit.

Security posture

Where your keys are kept

Every key value is stored in the macOS Keychain, under KeyRotate's own Keychain service. Names, labels, targets and settings live in a file in the app's own container, written so only your user account can read it. Nothing is stored on a server operated by Enfour. Keys sync through iCloud Keychain only if you turn that on in Settings; it is off by default.

The vault unlocks with Touch ID, or your Mac's login password where Touch ID is not available, once per session, and it locks again when KeyRotate leaves the foreground. While it is locked, the key list stays visible, but no key value can be shown or copied. Only the background jobs you set up yourself, such as a scheduled rotation, keep running and read the keys they need.

What the app is allowed to do

KeyRotate runs in Apple's App Sandbox. It can make outgoing network connections and open only the files and folders you pick yourself, remembered as security-scoped bookmarks. It cannot read your home folder, your ~/.ssh folder or other apps' data on its own. The only scripts it can run on your Mac are the ones you put in its Application Scripts folder yourself.

What leaves your Mac

KeyRotate has no analytics, crash reporting or usage tracking of any kind. It talks to the services you use, directly and over HTTPS: a vendor's own API to verify, rotate or read the usage of a key you stored, and the places you told it to write a key, such as a server over SSH, a hosting provider's secret store or your password manager. The privacy policy lists each case, including the optional Enfour push relay used for alerts and for pairing an iPhone or Apple Watch. The relay never receives a key value.

How rotation is done

A replacement key is checked with the vendor before it is stored, then checked again afterwards. If a step fails before the vendor has replaced the key, the previous key is kept. KeyRotate never revokes the old key itself, because anything still holding it would break at that moment. You revoke it at the vendor once everything uses the new one. Before changing a file, KeyRotate keeps a backup of it, so the change can be undone in one click. The exception is the AI proxy configuration files, which their apps reload as they change.

Supply chain

KeyRotate is distributed only through the Mac App Store, so the copy you install is the one Apple reviewed and signed. There is no separate download and no auto-updater outside the App Store.

The app is written by Enfour in Swift. It contains no advertising, analytics or crash-reporting code. Besides Apple's own frameworks, it includes these open-source packages, each pinned to a recorded version:

Everything else, including the vendor catalogue, the rotation engine and the leak scanner, is Enfour's own code.

Reporting a vulnerability

If you think you have found a security problem in KeyRotate, write to support at frontierstack dot app with “KeyRotate security” in the subject. Describe what you found, how to reproduce it and the app and macOS versions. Never include a real key, password or token. Use a revoked or made-up one.

We aim to acknowledge a report within five business days and to keep you informed while we work on it. We ask that you give us 90 days to ship a fix before you publish details, and we are glad to agree an earlier date once a fix is out. We will credit you when the fix ships if you would like that. Please do not test against other people's data or accounts.

When something goes wrong

If a problem in KeyRotate could have exposed your keys, we will say so in the App Store release notes of the version that fixes it and on this site, with what was affected and what you should do. That usually means rotating the keys concerned.

Breaches at the vendors you use are covered separately. KeyRotate's Leak news lists vendor breach advisories. The same list reaches the app's Guard screen, and, if you turned on Apple-push alerts, your devices. Enfour signs the list offline with an Ed25519 key, and KeyRotate refuses any copy whose signature does not verify. KeyRotate works out on your Mac whether an advisory affects the keys you hold, and names those keys.

Changes

We update this page when the app's security design changes. The date at the top shows the latest review.