Apple Notes Security Basics
Security Checklist
- [ ] Scripts run only locally (never expose osascript to network)
- [ ] No note content logged to files (may contain sensitive data)
- [ ] TCC permissions scoped to specific apps only
- [ ] Exported notes stored with appropriate file permissions
- [ ] iCloud account uses 2FA
- [ ] Automation scripts do not hardcode note content
AppleScript Sandbox Restrictions
# Apple Notes runs inside the macOS sandbox
# Scripts can only access Notes via Apple Events (not direct file access)
# The Notes database is at ~/Library/Group Containers/group.com.apple.notes/
# Direct database access is NOT recommended (encrypted, undocumented schema)
Safe Export Pattern
# Export with restricted permissions
osascript -l JavaScript -e "..." > /tmp/notes-export.json
chmod 600 /tmp/notes-export.json
# Process then delete
rm /tmp/notes-export.json
Resources