Verify host fingerprints
Check the fingerprint and key type against the Mac you intend to trust. Investigate an unexpected change before accepting a replacement key.
Use appropriate account access
Enable Remote Login only for the accounts that need it. MARC performs operations as the connected SSH account; its permissions apply to commands, files, and processes.
Keep credentials private
Manage saved credentials through Settings → Keychain. Never publish passwords, private keys, or API keys in screenshots, logs, or GitHub issues.
Understand where data lives
Statistics history lives on the Mac. File previews and downloads can create iPhone copies. Optional API AI sends requests to the configured provider. See the Privacy Policy for details.
Contact
For help with MARC or to report a security issue, email [email protected].
Include the details needed to understand the issue. Leave out passwords, private keys, and API keys.
Three things that serve different purposes
- Account password or SSH key: authenticates your Mac account.
- Host fingerprint: identifies the Mac you are trusting.
- AI API key: authenticates requests to an optional AI provider.
One does not replace the others. An AI API key does not sign you into your Mac, and a valid account password does not confirm that you reached the right machine.
Removing a profile is not a remote wipe
Removing a saved server removes its profile and login from MARC. It does not delete the Mac’s files, remove remote statistics history, or turn off Remote Login on macOS.
If you want to revoke access on the Mac, review the allowed Remote Login users and any authorized public keys there as well.