Overview
The Apple Supply Chain Scanner Policy installs swif-scan, Swif's supply chain scanner, on managed Macs. swif-scan looks for:
Exposed credentials: API keys, tokens, and private keys left in files, such as an AWS access key in a
.envfile. It can also check with the provider whether a key still works.Malicious packages: installed package versions that threat feeds list as malicious.
Vulnerable packages: installed packages with known vulnerabilities (CVEs).
The Swif agent installs, runs, updates, and removes swif-scan, and reports what it finds to Swif. swif-scan is built to stay light: it limits its own CPU use, so Macs stay usable during a scan.
Important: The full credential is never sent to Swif. When swif-scan finds a credential, it reports the type of key, where it was found, a fingerprint, the key's length, and at most its first 8 characters. The full key never leaves the Mac. If you turn on credential verification, the key is sent only to its own provider, for the check.
Requirements
Requirement | Details |
Platform | macOS 13 or later |
Device ownership | Company-owned and BYOD |
Swif agent | Installed and running |
Full Disk Access | Granted automatically by the policy's profile, so swif-scan can read Desktop, Documents, and Downloads |
Network | HTTPS (port 443) access to the hosts in Network requirements below |
How it works
You assign the policy to your Macs.
Each Mac gets a profile with the scanner's settings, and Full Disk Access for swif-scan.
The Swif agent installs swif-scan, signed by Swifteam Inc., in
/usr/local/swif-scan/.The first scan starts within about 10 minutes. After that, the agent runs a scan once a day, in the background.
The agent collects the results, and sends them to Swif.
The scanner maintains itself
Situation | What happens |
Nothing changed since the last report | The report isn't sent again. Unchanged results are re-sent after 7 days. |
You edit the policy | swif-scan isn't reinstalled. New settings apply from the next scan. |
swif-scan is deleted, or its owner or permissions are changed | The agent reinstalls a clean, signed copy within 10 minutes. |
A new swif-scan version is released | The agent updates it within 6 hours. If a scan is running at that moment, the update waits for the next check, 6 hours later. |
You unassign the policy | Within about 2 minutes, any running scan is stopped, and swif-scan and its data are removed from the Mac. |
Settings reference
Credentials
Setting | What it does | Default | Range |
Scan for Credentials | Looks for API keys, tokens, and private keys in files on the Mac | On | — |
Largest File to Read (MB) | swif-scan skips files larger than this, and reports them as not checked, not as clean. | 16 | 0–512 |
Verify Credentials with Their Provider | Asks each key's provider whether the key still works, so you can tell a live key from a revoked one | On | — |
Providers Not to Ask | Providers swif-scan never contacts, for example for contractual reasons. Their keys are reported as unverified. Shown when verification is on. | Empty | Letters, digits, |
Verification Timeout (seconds) | How long swif-scan waits for one provider's answer. A check that times out is reported as failed, not as invalid. Shown when verification is on. | 10 | 1–60 |
About verification
Provider audit logs: the checks appear in each provider's audit logs, for example in AWS.
Proxies: checks may fail behind a proxy that blocks them.
How Providers Not to Ask matches: an entry such as
awsorgithubcovers every detector whose name starts with it.google,amazon,microsoft,hashicorp,vault,1password,xai, andcrates.ioalso cover their related detectors.
Packages
Setting | What it does | Default |
Check for Malicious Packages | Matches installed packages against known malicious packages from OSV, Aikido, Datadog, and VSX Sentry. Covers npm, PyPI, RubyGems, Go, Maven, and more, plus VS Code extensions. | On |
Check for Vulnerable Packages | Also matches installed packages against known vulnerabilities (CVEs) | Off |
A malicious package finding means remove the package. Upgrading it isn't enough.
Plan before turning on vulnerability checks. They can report hundreds of findings on one Mac. Decide how your team will review and prioritize them first.
Where to scan
Setting | What it does | Default |
Folders to Scan | The folders swif-scan checks for credentials and project packages, as absolute paths, such as | Empty (every user's home folder) |
Mask File Paths | Findings show a masked path instead of the full one, so user, customer, and project names in paths don't reach Swif. Finding the file to fix gets harder. | Off |
Folders to Scan doesn't limit package checks. With package checks on, swif-scan also checks software installed on the Mac, under /usr/local, /opt, and /Library, and global Ruby gems. These are checked even if they're outside Folders to Scan.
Advisory data
swif-scan downloads advisory data only for the package types it finds on the Mac. A package type's data is downloaded again only when OSV has changed it, but then in full. npm's data (about 220 MB) and PyPI's (about 37 MB) change most days, so a Mac with npm packages can download about 220 MB a day. RubyGems' and Go's data change every few days.
Setting | What it does | Default | Range |
Advisory Data Mirror | Where swif-scan downloads OSV's advisory data from. Leave empty to download from OSV directly. | Empty | An |
Disk Budget for Advisory Data (MB) | The disk space swif-scan can use for advisory data. An archive that doesn't fit is refused, and the check it's for is reported as failed. | 512 | 64–8,192 |
Using a mirror. A mirror must serve OSV's own layout (<url>/ecosystems.txt and <url>/<ecosystem>/all.zip), and must be kept up to date. It doesn't make the download smaller. Malware lists from Aikido, Datadog, and VSX Sentry are still downloaded from their own sites.
Performance
Setting | What it does | Default | Range |
CPU Budget (% of one core) | swif-scan pauses as needed to stay under this share of one CPU core. A lower budget makes scans take longer. | 15 | 1–35 |
Longest Scan (hours) | A scan that runs out of time stops, and is reported as partial. The next scan continues where it left off. A partial scan never marks an earlier finding as resolved. | 6 | 1–12 |
In testing with swif-scan 1.1.14, a scan took about 2.5 minutes, with an average CPU use of 15% of one core (29% at peak), and peak memory of 31 MB.
What's reported
Section | Details |
Coverage | Which checks ran, and which the policy turned off |
Credentials | The type of key (such as |
Package findings | Whether each package is malicious or vulnerable, its ecosystem (such as npm or PyPI), version, and location, the advisory and CVE IDs, severity, and why it matched, such as "exact version 2.19.0 is listed as affected" |
Scan statistics | Duration, folders scanned, files checked, average and peak CPU use, and peak memory |
What's reported for each credential
Item | Details |
Key type | For example, |
Location | The file and line number. The path is masked when Mask File Paths is on. |
Fingerprint | A one-way fingerprint of the key, created with a random secret that's generated on the Mac and never leaves it. It can't be reversed, and the same key on two Macs gets two different fingerprints. |
First characters | At most 8 characters, never more than half the key, and none for keys shorter than 16 characters. For an AWS key, it's the start of the access key ID ( |
Length, verification result, and first and last seen | — |
Network requirements
swif-scan connects only to these hosts, over HTTPS on port 443.
Purpose | Hosts |
Installing swif-scan |
|
OSV advisory data |
|
Aikido malware list |
|
Datadog and VSX Sentry malware lists |
|
Credential verification (only when on, and only the provider of a key that was found) |
|
Each Mac downloads advisory data only for the package types it has.
Before you start
Check your network. Make sure Macs can reach the hosts in Network requirements. If you use a proxy, check that it allows these requests.
Decide on credential verification. Verification shows which keys still work, but the checks appear in providers' audit logs. List any providers swif-scan shouldn't contact in Providers Not to Ask.
Plan for findings. Decide who will act on exposed credentials and malicious packages. If you turn on vulnerability checks, plan how to handle a large number of findings.
Consider privacy, especially on BYOD Macs. Turn on Mask File Paths if file paths could contain personal or customer names.
Choose a pilot group of Macs.
Create the policy
In Swif, go to Device Management > Policies, then select Create new policy > Configure a Policy.
Select Apple Supply Chain Scanner Policy.
Enter a clear name, such as
Supply Chain Scanner – Pilot.Review the settings. The defaults suit most organizations.
Save the policy.
Assign it to your pilot Macs.
Example configurations
Example 1: Find exposed credentials and malicious packages (defaults)
Setting | Value |
Scan for Credentials | On |
Verify Credentials with Their Provider | On |
Check for Malicious Packages | On |
Check for Vulnerable Packages | Off |
The recommended starting point. You'll see exposed keys, whether they still work, and any malicious packages, without a large number of vulnerability findings.
Example 2: Privacy-focused scanning for BYOD Macs
Setting | Value |
Scan for Credentials | On |
Verify Credentials with Their Provider | Off |
Check for Malicious Packages | On |
Folders to Scan |
|
Mask File Paths | On |
Scans only shared project folders, doesn't contact providers, and masks file paths in findings. System-wide packages are still checked.
Example 3: Developer Macs with vulnerability checks
Setting | Value |
Check for Malicious Packages | On |
Check for Vulnerable Packages | On |
CPU Budget (% of one core) | 25 |
Disk Budget for Advisory Data (MB) | 2048 |
Adds vulnerability findings, with more CPU and disk space for large projects.
Verify the policy
In Swif, open the device, and confirm that the policy shows as applied.
On the Mac, check that swif-scan is installed:
ls /usr/local/swif-scan/
The first scan starts within about 10 minutes of the policy reaching the Mac. Its results reach Swif within about 10 minutes after it finishes.
Troubleshooting
Credential checks show as failed
The provider didn't answer within Verification Timeout (seconds). A failed check doesn't mean the key is invalid.
A proxy may be blocking the requests. Check that Macs can reach the providers.
A package check shows as failed
The advisory data didn't fit in Disk Budget for Advisory Data (MB), or couldn't be downloaded. Increase the budget, or check that Macs can reach the advisory data sources.
A scan is reported as partial
It ran longer than Longest Scan (hours). The next scan continues where it left off. Raise Longest Scan (hours) or CPU Budget (% of one core) if scans regularly don't finish.
Package findings come from outside Folders to Scan
This is expected. Folders to Scan limits credential and project checks, but with package checks on, swif-scan also checks software installed under /usr/local, /opt, and /Library, and global Ruby gems.
A file shows as not checked
It's larger than Largest File to Read (MB), or it's outside Folders to Scan. Increase the limit, set it to 0 for no limit, or add the folder.
A security tool flags swif-scan
Add /usr/local/swif-scan/ to your security tool's exclusions. For CrowdStrike Falcon, see Configuring CrowdStrike Falcon Exclusions for Swif.ai.
swif-scan is still on a Mac after I removed the policy
Removal takes about 2 minutes after the policy is unassigned. Check that the Mac is online, and has received the change.