向GitHub上传编译AppleScript及.scpt文件的安全性技术问询

Let’s break down your questions about compiled AppleScript files and their safety on GitHub—this is a common concern for anyone working with AppleScript automation, so it’s great you’re asking!

Do .scpt files store undo history or old version information? #

The short answer is no. Compiled .scpt files are binary bytecode files generated by Script Editor, and they only contain the compiled version of your current script code. When you save a compiled script, Script Editor discards any temporary editing data—like undo history, draft changes, or old version snapshots—since those aren’t needed for the script to run. The file only holds the bytecode required to execute the script, not any traces of your editing process.

Is it safe to share an old .scpt file (with passwords/proprietary info) on GitHub? #

Absolutely not, but not because of old version history—here’s why:
Compiled AppleScript files are not "encrypted" or obfuscated in a way that prevents reverse-engineering. macOS includes a built-in command called osadecompile that can convert a .scpt file back into readable, nearly identical source code in seconds.

If that old .scpt file was compiled from a script that included hard-coded passwords, API keys, or proprietary business logic, anyone who downloads it can run osadecompile your-script.scpt and see all that sensitive information plain as day. Even if you’ve since updated the script to remove those details, sharing the old compiled version (which still contains the sensitive data) puts that info at risk.

Is it safe to upload compiled AppleScript files to GitHub in general? #

It depends entirely on what’s in your script:

• If your script has no sensitive content: Uploading a .scpt isn’t technically unsafe, but it’s not ideal for collaboration. GitHub can’t render binary files for viewing, so other developers won’t be able to read the script’s code directly, compare versions, or submit changes easily. For most cases, uploading the plain-text version of your script (save as .applescript or choose "Text" format when saving .scpt in Script Editor) is a better choice.
• If your script contains sensitive information: Don’t upload it—even compiled. As mentioned earlier, osadecompile can reverse-engineer the bytecode back to source, exposing any passwords, keys, or proprietary data you’ve included.

内容的提问来源于stack exchange，提问作者supermitch