Is Keepresso safe? Open source and notarized

Keepresso is a small, focused app, and it is easy to check what it does. It is free and GPL-3.0-licensed, so the full source is public, and it is signed and notarized by Apple, so it opens without warnings.

What permissions it asks for

Keepresso asks for very little, and only when you use a feature that needs it:

• Administrator approval, once, only for the features that flip a protected system setting: closed-display mode, the gaming AWDL pause, the thermal safety net's fan boost, a game's CPU priority, and a scheduled wake. Approve the helper a single time and they are silent after that.
• Location, only if you use a Wi-Fi trigger, because reading the current network name needs it on modern macOS. Nothing else uses your location.
• Notifications, only for the still-brewing reminder and the battery and thermal pause notices.

What it does not touch

• No camera or microphone permission. The meeting trigger reads only the system signal that a camera or mic is in use, the same thing that lights the dots in your menu bar. It never opens a stream.
• No Accessibility permission.
• No trackers, no analytics, no account.

Guardrails you might not notice

A few deliberate choices keep the sharp edges covered:

• Imported settings cannot run commands unseen. Importing a settings file brings in any shell-command event hooks switched off. You review and re-enable the ones you trust under Preferences, Automation, so a shared or downloaded settings file cannot run a command behind your back.
• Automation stays on your terms. Automation leases are bounded and self-expiring, a switch turns them off entirely, and letting automation change the system wake schedule is a separate opt-in that is off by default.
• Updates are locked down. The auto-updater is pinned to an exact Sparkle version with its signing tools verified by checksum, and every release is signed and notarized. The agent-hook and administrator-helper commands are hardened against untrusted input.

Why it is not on the Mac App Store

The App Store sandbox blocks the macOS power APIs Keepresso relies on to keep your Mac awake. So it ships outside the store, with Apple's hardened runtime on and full notarization, the standard, trusted way to distribute a Mac app that needs those capabilities.