Files and Folders (Files and Folders) is a macOS privacy permission. Files and Folders permission grants an app access to specific directories on your Mac — typically Desktop, Documents, Downloads, removable volumes, or network volumes. Unlike Full Disk Access, this permission is more granular and you can control which folders each app can reach. Common apps that request this permission include Visual Studio Code, Sublime Text, Dropbox, Adobe Photoshop, iTerm2. Risk level: caution. To check which apps have this permission, open System Settings, go to Privacy & Security, and select Files and Folders. CoreLock maps out every app's file and folder permissions, showing which apps can access your Desktop, Documents, and Downloads. It identifies apps with excessive folder access relative to their function and flags potential data exfiltration risks.
Files and Folders permission grants an app access to specific directories on your Mac — typically Desktop, Documents, Downloads, removable volumes, or network volumes. Unlike Full Disk Access, this permission is more granular and you can control which folders each app can reach.
Click the Apple menu and select System Settings.
Click Privacy & Security in the sidebar.
Click Files and Folders. Each app is listed with the specific directories it can access (Desktop, Documents, Downloads, etc.).
Expand each app to see exactly which folders it can access. Revoke access to any folder the app doesn't need. For example, a code editor might only need Documents access, not Downloads.
Go to System Settings > Privacy & Security > Files and Folders.
Expand the app and toggle off individual folders. You can allow Desktop access but deny Documents, for example.
If you're not sure why an app has folder access, toggle everything off. The app will prompt you again next time it needs access, letting you decide in context.
CoreLock maps out every app's file and folder permissions, showing which apps can access your Desktop, Documents, and Downloads. It identifies apps with excessive folder access relative to their function and flags potential data exfiltration risks.
Files and Folders is granular — you control which directories each app can access. Full Disk Access is all-or-nothing — it grants access to every file on your Mac, including protected areas like Mail, Messages, and Safari data. Always prefer Files and Folders over Full Disk Access when possible.
Code editors need to read and write files in your project directories. They typically request access to Desktop and Documents where most people store projects. You can limit access to only the specific directories where your code lives by denying the broader permission and granting access folder-by-folder when prompted.
The system-level permission works at the directory category level (Desktop, Documents, Downloads). For more granular control, deny the broad permission and the app will prompt you for specific folders when it needs access. You can approve individual folder access through those prompts.
CoreLock scans every app on your Mac and shows you exactly which permissions each one has. Find hidden access in under 60 seconds.
Download CoreLock FreeAvailable for macOS and Windows