Security & privacy

ProxyHawk is a powerful debugging tool. With that power comes responsibility: you are deliberately placing a trusted MITM on your machine or devices.

Threat model (short)

• Insider / malware on the same machine may read capture databases, memory, or exported HAR/cURL that contain tokens.
• CA compromise — if someone obtains or abuses your trusted Proxy Hawk CA, they may intercept TLS for clients that trust that CA.
• Network position — if the proxy listens beyond localhost (misconfiguration), other hosts on the LAN might connect.
• User‑controlled rules — Map Remote, scripts, and breakpoints can send traffic to unexpected destinations if misconfigured.

This is the same category of risk as other desktop MITM debuggers (e.g. Proxyman, Charles). The product does not remove TLS cryptography on the public internet—it terminates TLS locally when you opt in via CA trust and SSL lists.

Certificate authority

Generate one CA per machine or team policy; do not copy a trusted CA profile to untrusted devices. Revoke / delete trust when debugging ends. If you suspect exposure, regenerate the CA in ProxyHawk and re‑install trust everywhere you need it.

Sensitive data

Captured traffic can include passwords, OAuth tokens, cookies, PII, and proprietary APIs. Treat the ProxyHawk window like a password manager screen:

• Avoid screen‑sharing or recordings while sensitive traffic is visible.
• Sanitize exports (HAR, markdown, cURL) before attaching to tickets or chat.
• Prefer narrow SSL include lists so unrelated banking or health traffic stays tunneled.

Local processing

The app is built so capture and display happen on your Mac. There is no requirement to upload HTTP content to a vendor cloud for core capture—verify your specific build and any optional analytics or crash reporting in Settings / distribution channel.

Helper & system proxy

macOS integration may use a privileged helper and Login Items approval for automatic proxy toggles. Only enable what you need; review Apple’s prompts carefully.

Responsible use

Only intercept traffic you are authorized to inspect (your apps, your QA environments, or with explicit consent). Intercepting third‑party users’ production traffic without consent may violate law and policy.