One command, in a copy of the source. It needs no Xcode, no account and no build, so you can
run it before you download anything.
git clone https://github.com/Mannafee/zielzeit-scalable-capital
cd zielzeit-scalable-capital
make audit
Zielzeit audit — against Sources/, not against the README
✓ broker write commands none the only broker verbs are overview, savings-plans, transactions
✓ broker commands enumerated 5 overview, savings-plans, transactions, whoami, installation-code
✓ networking code none no URLSession, Network.framework or socket API in the app
✓ shell invocation none one Process(), run by absolute path with an argument array
✓ credential access none no Keychain, no token, no read of the CLI's session
✓ values stored on disk 3 goal, language, hasRequestedAccess — no figures
✓ third-party dependencies 1 Sparkle, the updater — nothing else
7 of 7 checks passed. Re-run with -v for every search and its output.
Add -v and it prints every search it made, so a passing run is evidence rather
than a green tick. And
SECURITY.md
states what no automated check can cover — including the two things that are true and not
reassuring.