DiskShelf is built around a single invariant: the app never writes to the drives it scans.

• A scan is nothing but directory enumeration plus attribute reads (name, size, dates). There is not a single write, move or delete call aimed at a scanned volume anywhere in the codebase.
• The invariant is pinned by the automated test testScanLeavesVolumeUntouched: a volume's file set, sizes and modification dates must be identical before and after a scan.
• The space planner only produces a textual plan — the user performs any moves themselves.
• "Forget drive" deletes records from the app's own database only.
• All app data lives locally in ~/Library/Application Support/DiskShelf/ (the SQLite catalog and, when enabled, JPEG previews). Nothing is uploaded anywhere: the app contains no networking code at all.
• Drive access goes through standard macOS mechanisms (the removable-volume consent dialog / NSOpenPanel + security-scoped bookmarks in the sandboxed build), read-only.

Open an issue tagged security or contact the author directly, including reproduction steps.