GhostWatch v3.2.1

Bug Fixes

• Login Items — UUID display: Login items with UUID-style launchctl labels (e.g. Ollama, Electron apps) now resolve to their correct application name instead of displaying a raw UUID.
• Dashboard sidebar — date filter: Category sidebar counts and severity breakdown bar now correctly reflect the selected time range (Today, 3 days, 7 days, 30 days).
• Permissions — FDA detection: Full Disk Access status now accurately reflects the actual permission state. The Settings panel re-checks all permissions when the app returns to the foreground.
• Notifications — delivery after permission granted: The notification manager now queries the live authorization status before each delivery. Notifications also display correctly when GhostWatch is the active app.

Security Hardening

• App restart mechanism: No longer uses shell string interpolation — calls /usr/bin/open directly via Process API.
• FileWatcher symlink protection: Monitored paths are verified not to be symbolic links before watching.
• Database migration logging: Full error reporting instead of silent suppression.

Architecture Changes

• Removed App Sandbox (incompatible with system-wide monitoring for ad-hoc signed builds)
• Proper ad-hoc code signing with Hardened Runtime and sealed resources

Note: The first launch after updating from 3.2.0 starts with a fresh event database.

Download

Download GhostWatch-3.2.1.dmg below, open it, and drag GhostWatch to your Applications folder.

GhostWatch v3.2.0

GhostWatch v3.2.0

New: Applications Monitor

GhostWatch now monitors /Applications and ~/Applications for changes:

• New app installed — detects when an application is added
• App removed — alerts if an application is deleted (especially useful for security tools)
• App updated — tracks version changes

All features

• 16 security monitors (LaunchAgents, Login Items, Hosts File, Firewall, SSH Keys, Browser Extensions, Applications, and more)
• Real-time dashboard with search, filters, and severity indicators
• Event timeline with date range filtering (Today, 3 days, 7 days, 30 days, All)
• Statistics with charts
• Export to JSON, CSV, or HTML
• macOS native notifications
• Bilingual: English & French
• 100% offline — no data leaves your Mac

Installation

1. Download GhostWatch-3.2.0.dmg below
2. Open the DMG and drag GhostWatch to Applications
3. Launch GhostWatch and grant Full Disk Access for complete coverage

See the User Guide for detailed setup instructions.

System Requirements

• macOS 14.0 (Sonoma) or later
• Apple Silicon or Intel Mac

GhostWatch v3.1.0

GhostWatch v3.1.0

Silent Mac security monitor — detects unauthorized changes to your system.

Features

• 15 security monitors (LaunchAgents, Login Items, Hosts File, Firewall, SSH Keys, Browser Extensions, and more)
• Real-time dashboard with search, filters, and severity indicators
• Event timeline with date range filtering (Today, 3 days, 7 days, 30 days, All)
• Statistics with charts
• Export to JSON, CSV, or HTML
• macOS native notifications
• Bilingual: English & French
• 100% offline — no data leaves your Mac

Installation

1. Download GhostWatch-3.1.0.dmg below
2. Open the DMG and drag GhostWatch to Applications
3. Launch GhostWatch and grant Full Disk Access for complete coverage

See the User Guide for detailed setup instructions.

System Requirements

• macOS 14.0 (Sonoma) or later
• Apple Silicon or Intel Mac