Review local trust and permissions

Development work accumulates trust. Local HTTPS tools install certificates so https://localhost stops warning. Terminals and editors request privacy permissions — Full Disk Access, Accessibility, screen recording — so one workflow can run. Debuggers and automation ask for more.

These changes outlive the experiment that created them. The certificate a tool installed for a prototype in March still shapes what your Mac trusts in December, long after you deleted the prototype.

Record grants when you make them

The cheap fix is a log. Record every added trust item and permission with its purpose, owner, and removal command or settings path:

## Trust and permission log

- 2026-06-12 — mkcert root CA in login keychain — local HTTPS for shop-frontend
  — remove: `mkcert -uninstall`
- 2026-07-02 — Terminal: Full Disk Access — integration tests read ~/Library
  — remove: System Settings > Privacy & Security > Full Disk Access

Without the log, a later audit shows you a list of grants and no way to tell which are load-bearing. With it, cleanup is mechanical.

Review after each project

Review Keychain Access and Privacy & Security after finishing the project. In Keychain Access, look through your login keychain’s Certificates category for development roots you added. From the command line you can check what carries custom trust settings:

security dump-trust-settings
# SecTrustSettingsCopyCertificates: No Trust Settings were found.

That output is the healthy state for the user domain: no manually trusted certificates. Anything listed instead deserves a line in your log — or removal.

Then open System Settings, Privacy & Security, and walk Full Disk Access and Accessibility. Toggle off anything belonging to tools you no longer run.

The setup-guide trap

Here is the failure mode to refuse: a copied setup guide says “just add the root certificate” or “grant your terminal Full Disk Access” as step one, without saying why. A broad root certificate means your Mac silently trusts every website that certificate’s key chooses to sign. Full Disk Access means every script your terminal runs reads everything your user can.

Do not install a broad root certificate or grant Full Disk Access because a copied setup guide says so. Verify the publisher, scope, and exact feature first — and if the guide cannot tell you which feature breaks without the grant, that is your answer.