Trust should have receipts.
Some of what lands in a folder is worth opening carefully — a page you didn't write, a file you haven't read yet. Superset previews those inside a boundary, so opening them is safe. This page states the trust model, the security architecture, and the proof behind it, plainly.
Scripts are off until you say otherwise.
HTML is the file type most likely to carry a script, so it gets the most deliberate handling. Every HTML preview renders in a sandboxed, isolated surface — separate from the rest of the workspace — and scripts are off by default.
- The preview opens isolated. An HTML file renders in a sandboxed surface before any decision about scripts is made.
- Scripts default to off. Nothing on the page runs until you explicitly allow it.
- You enable scripts per file, on purpose. The choice applies to that file and persists for it — it is not a blanket setting you forget about.
- Untrusted pages stay fenced in. A page you haven't trusted is held to strict limits on what it can load and reach.
An optional setting can allow scripts by default across the app. It is off by default.
Pipeline dashboard
Four boundaries, not one promise.
The trust model above sits on top of a small set of structural decisions in how the app is built.
Sandboxed renderer
Web content — HTML, and anything it tries to run — has no direct filesystem access. It renders inside a sandbox, separate from the app's own privileges.
Files served on the app's own terms
Previews receive files through a private channel the app controls, never the browser engine's raw file access. Content loads under the app's rules, not the web's defaults.
Untrusted pages are boxed in
A page you haven't trusted is held to strict limits on what it can load and reach, on top of the sandbox and the scripts-off default.
Scoped filesystem access
The app can read and write within the folders you open — not an arbitrary path on your Mac. Opening a folder is the boundary.
I've run two adversarial security reviews against this architecture myself — not a third-party audit. The security policy covers the full posture and how to report issues.
The proof behind the claims.
Every release runs through an automated safety net first: your files open unchanged and previews stay sandboxed. The build you download is the build that passed.
No analytics, no accounts, no tracking. The app reaches the network only to check for updates and to validate your license — nothing about your files or folders ever leaves your Mac.
The current release opens like any trusted Mac app, and its update loop — check, download, install — has been verified working.
every claim on this page is checked against the codebase, not asserted
Private by default.
Superset Files keeps to itself. There are no analytics, no accounts, and no usage tracking — the app reaches the network only to check for updates and to validate your license when you buy it.
Crash reporting is the one thing you can turn on — an opt-in integration that stays off until you enable it, and sends a redacted crash report only when the app actually crashes. Nothing about your files or folders is ever sent.
The full privacy policy spells this out in detail — what's collected, why, and the limited times the app uses the network.
What a purchase grants, plainly.
Superset Files is a one-time license, not a subscription. The terms below describe what that license covers.
- A perpetual personal license to the official signed builds
- License activation on your own Macs
- Updates within the major version you buy
- A support path by email