TrafficWeaverPermissions
TrafficWeaver asks for more than a normal Mac app does. Here is exactly what it asks for, why, and what it can see once you agree.
Two approvals during setup
1. Allow the system extension
Routing traffic per application requires a Network Extension running outside the app. macOS will not load one without your explicit consent, so the first time you press Install Extension you have to allow it in System Settings. Where that lives moved between releases: on Sequoia and later it is General → Login Items & Extensions → Network Extensions, and on Ventura and Sonoma it is under Privacy & Security. The app links you straight to the right pane. The approval dialog shows the developer name on the signing certificate, Alexey Erenkov, rather than the product name.
2. Allow it to filter network content
macOS then asks whether the extension may handle network traffic. This is the standard prompt every tool of this kind produces, including firewalls and VPN clients.
Neither approval can be pre-granted by an installer. Only a device managed by an organisation through MDM can skip them.
What the extension can see
For each outbound connection it receives the source application, the destination address and port, and — when macOS provides it — the destination host name. It also relays UDP datagrams, which is how DNS and QUIC can follow your rules.
It reads DNS answers as they pass through in order to learn which host name an IP address
belongs to. That is what makes a rule like *.example.com work for applications
that resolve names themselves. The mapping is held in memory, is discarded when the extension
stops, and never leaves your Mac.
It does not decrypt TLS. It cannot read the contents of encrypted connections and does not try. Traffic that matches a proxy rule is forwarded byte for byte to the proxy you configured; everything else is handed straight back to macOS untouched.
What leaves your Mac
| Your traffic | Only to the proxy servers you configure, and only for connections your own rules match. |
|---|---|
| Connection log | Stays on your Mac. Exporting it to CSV is a manual action you take. |
| Licence activation | Licence key, a salted one-way fingerprint of the machine, app and macOS version. Never the raw hardware identifier, and never anything about your traffic. |
| Update checks | A request for the update feed, which reveals your IP address, app version and macOS version — the same as any software updater. |
| Crash reports | Nothing unless you turn them on. They are off by default. |
Where it runs and with what privileges
The extension runs as a system service under the root account, because that is how macOS runs Network Extensions of this type. The application itself runs as you. Both are signed with the same Apple Developer ID and notarized by Apple, which is what lets macOS load them at all: a modified copy loses its signature and the system refuses to start the extension.
Proxy passwords are not written to the profile file on disk. They are handed to the extension through the system's own Network Extension configuration store.
Removing it
Quit TrafficWeaver and drag it to the Trash. macOS removes the extension along with the app;
you can confirm in System Settings, in the same place you approved it. Your rules stay in
~/Library/Application Support/TrafficWeaver in case you reinstall, and deleting
that folder removes them.