This is far from perfect, but *mostly* working. For example, it does not correctly clear certain recents.

macos_privacy.sh

#!/bin/zsh

# ====================
# Privacy Protection Script
# Author: lnxd
# https://gist.github.com/lnxd/7f0b1978752e99dedeff4a920410ea6d
# ====================

echo "- Starting Privacy Protection Script"

# Get sudo early on
echo "- Requesting sudo access"
sudo -v

# Confirm sudo is working
if ! sudo -n true; then
  echo "Error: Sudo is not working. Please check your sudo configuration."
  exit 1
fi

# Check if PlistBuddy exists before continuing
command -v /usr/libexec/PlistBuddy >/dev/null || {
  echo "Error: PlistBuddy not found at /usr/libexec/PlistBuddy. Exiting."
  exit 1
}

# Check if ~/Scripts/privacy.sexy exists, if it does then run it with sudo
if [ -f ~/Scripts/privacy.sexy ]; then
  echo "- Running ~/Scripts/privacy.sexy with sudo"
  sudo ~/Scripts/privacy.sexy
fi

# ====================
# Helper functions
# ====================

# Function to gracefully quit and clean up an application
quit_and_cleanup_app() {
  local app_name="$1"
  local app_bundle="$2"
  local process_name="${3:-$app_name}"
  
  echo "- Attempting to gracefully quit $app_name"
  osascript -e "tell application \"$app_name\" to quit" 2>/dev/null || killall "$process_name" 2>/dev/null
  
  # Wait up to 10 seconds for application to quit
  for i in {1..10}; do
    if ! pgrep -x "$process_name" > /dev/null; then
      echo "- $app_name has quit successfully."
      break
    fi
    sleep 1
  done
  
  # Force quit if still running
  if pgrep -x "$process_name" > /dev/null; then
    echo "- $app_name did not quit, force killing"
    pkill -9 -x "$process_name" 2>/dev/null || killall -9 "$process_name" 2>/dev/null
  else
    echo "- No need to force quit $app_name."
  fi
  
  echo "- Removing $app_name preferences and related data"
  rm -rf ~/Library/Preferences/$app_bundle.plist
  rm -rf ~/Library/Containers/$app_bundle 2>/dev/null
  rm -rf ~/Library/Application\ Support/$app_name 2>/dev/null
  rm -rf ~/Library/Caches/$app_bundle 2>/dev/null
  rm -rf ~/Library/Saved\ Application\ State/$app_bundle.savedState 2>/dev/null
  
  # Clear recent items
  defaults write $app_bundle NSRecentItems -array 2>/dev/null
}

# ====================
# System Privacy Settings
# ====================

echo "- Configuring System Privacy Settings"

# Disable sending diagnostic and usage data to Apple
echo "- Disabling diagnostic and usage data submission"
sudo defaults write /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory AutoSubmit -bool false
sudo defaults write /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory AutoSubmitVersion -int 4
sudo chflags uchg /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory.plist

# Disable App Analytics
echo "- Disabling App Analytics"
sudo defaults write /Library/Preferences/com.apple.appleseed.FeedbackAssistant Autogather -bool false
sudo chflags uchg /Library/Preferences/com.apple.appleseed.FeedbackAssistant.plist

# Disable Crash Reporter dialogs
echo "- Disabling Crash Reporter dialogs"
sudo defaults write /Library/Preferences/com.apple.CrashReporter DialogType -string "none"
sudo chflags uchg /Library/Preferences/com.apple.CrashReporter.plist

# Disable Spotlight Suggestions
echo "- Disabling Spotlight Suggestions"
sudo defaults write /Library/Preferences/com.apple.Spotlight SuggestionsEnabled -bool false
sudo chflags uchg /Library/Preferences/com.apple.Spotlight.plist

# ====================
# Browser Privacy Settings
# ====================

echo "- Configuring Browser Privacy Settings"

# Disable Safari from sending search queries to Apple
echo "- Disabling Safari from sending search queries to Apple"
sudo defaults write /Library/Preferences/com.apple.Safari UniversalSearchEnabled -bool false
sudo defaults write /Library/Preferences/com.apple.Safari SuppressSearchSuggestions -bool true
sudo chflags uchg /Library/Preferences/com.apple.Safari.plist

# Enable Safari Developer Menu and Web Inspector
echo "- Enabling Safari Developer Menu and Web Inspector"
defaults write com.apple.Safari IncludeDevelopMenu -bool true
defaults write com.apple.Safari WebKitDeveloperExtrasEnabledPreferenceKey -bool true
defaults write com.apple.Safari WebKitPreferences.developerExtrasEnabled -bool true
defaults write com.apple.Safari.SandboxBroker ShowDevelopMenu -bool true

# ====================
# Security Settings
# ====================

echo "- Configuring System Security Settings"

# Enable Firewall with stealth mode
echo "- Enabling Firewall with stealth mode"
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
sudo pkill -HUP socketfilterfw

# Disable guest user login
echo "- Disabling guest user login"
sudo defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false
sudo chflags uchg /Library/Preferences/com.apple.loginwindow.plist

# Setting password policies
echo "- Setting password policies"
sudo defaults write /Library/Preferences/com.apple.screensaver askForPassword -bool true
sudo defaults write /Library/Preferences/com.apple.screensaver askForPasswordDelay -int 300
sudo chflags uchg /Library/Preferences/com.apple.screensaver.plist

# Enable Gatekeeper (strict mode)
echo "- Enabling Gatekeeper (strict mode)"
sudo spctl --master-enable

# ====================
# Update Settings
# ====================

echo "- Configuring Update Settings"

# Configure software updates
echo "- Enforcing automatic updates and silent security updates"
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool true
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticInstall -bool true
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool true
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -bool true

# Disable automatic app downloads and updates
echo "- Disabling automatic app downloads and updates"
sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdate -bool false
sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdateRestartRequired -bool false
sudo chflags uchg /Library/Preferences/com.apple.commerce.plist

# ====================
# UI and Recent Items Settings
# ====================

echo "- Configuring UI and Recent Items Settings"

# Disable "Show suggested and recent apps in Dock" for all users
echo "- Disabling 'Show suggested and recent apps in Dock'"
sudo defaults write /Library/Preferences/com.apple.dock show-recents -bool false
sudo chflags uchg /Library/Preferences/com.apple.dock.plist

# Removing recent items from the Dock
echo "- Removing all recent items from the Dock"
defaults write com.apple.dock ShowRecentApplications -bool false
defaults write com.apple.dock ShowRecentFolders -bool false
defaults write com.apple.dock ShowRecentTags -bool false

echo "- Removing 'Recents' from Finder sidebar"
/usr/libexec/PlistBuddy -c "Delete :systemitems:VolumesList:0" ~/Library/Preferences/com.apple.sidebarlists.plist 2>/dev/null || true

# ====================
# Application Recent Items Clearing
# ====================

echo "- Cleaning Application Data and Recent Items"

# QuickTime Player
quit_and_cleanup_app "QuickTime Player" "com.apple.QuickTimePlayerX" "QuickTime Player"
rm -rf ~/Library/Logs/QuickTime\ Player.log

# TextEdit
quit_and_cleanup_app "TextEdit" "com.apple.TextEdit" "TextEdit"

echo "- Configuring TextEdit preferences"
# Set plain text as the default format for new documents
defaults write com.apple.TextEdit RichText -int 0
# Disable smart quotes
defaults write com.apple.TextEdit SmartQuotes -bool false
# Disable smart dashes
defaults write com.apple.TextEdit SmartDashes -bool false
# Disable automatic spelling correction
defaults write com.apple.TextEdit CheckSpellingWhileTyping -bool false
# Configure TextEdit to open with a blank document by default
defaults write com.apple.TextEdit NSShowAppCentricOpenPanelInsteadOfUntitledFile -bool false

# IINA
quit_and_cleanup_app "IINA" "com.colliderli.iina" "IINA"
rm -rf ~/Library/Logs/com.colliderli.iina

# Preview
quit_and_cleanup_app "Preview" "com.apple.Preview" "Preview"

echo "- Performing additional cleanup of Preview data"
defaults write com.apple.Preview NSNavLastRootDirectory -string "~"
defaults write com.apple.Preview NSNavLastCurrentDirectory -string "~"
rm -rf ~/Library/Application\ Support/Preview

# Disable Recent Items tracking in Preview
defaults write com.apple.Preview NSQuitAlwaysKeepsWindows -bool false
defaults write com.apple.Preview ApplePersistenceIgnoreState -bool YES
defaults write com.apple.Preview NSDocumentSaveNewDocumentsToCloud -bool false

echo "- Preview has been reset and configured for privacy."

# ====================
# Quick Look Cache Clearing
# ====================

echo "- Clearing Quick Look Cache"

echo "- Resetting Quick Look cache"
qlmanage -r cache

echo "- Removing Quick Look thumbnail cache directory"
rm -rf "$TMPDIR/../C/com.apple.QuickLook.thumbnailcache/"

echo "- Restarting the Quick Look daemon"
qlmanage -r

echo "- Quick Look cache and related data have been cleared successfully."

# ====================
# Finder Reset
# ====================

echo "- Removing all .DS_Store files"

# Use sudo to ensure permissions across all directories
# Suppress "Operation not permitted" errors by redirecting them to /dev/null
sudo find / -name '.DS_Store' -type f -not -path "/Volumes/*" -exec rm {} + 2>/dev/null

echo "- All accessible .DS_Store files have been removed."
echo "- Configuring Finder"

# Set Finder default view to 'List' and disable grouping
echo "- Setting Finder default view to 'List' and disabling grouping"
defaults write com.apple.finder FXPreferredViewStyle -string "Nlsv"
defaults write com.apple.finder FXPreferredGroupBy -string "None"


# ====================
# Apply Changes and Restart Services
# ====================

echo "- Applying Changes and Restarting Services"

# Restart Dock to apply changes
echo "- Restarting Dock"
killall Dock

# Restart Finder to apply changes
echo "- Restarting Finder"
killall Finder

# ====================
# System Security Checks
# ====================

echo "- Performing System Security Checks"

# Enable FileVault if not already enabled
echo "- Checking FileVault status"
if [ "$(fdesetup status | grep -c "FileVault is On")" -eq 0 ]; then
  echo "- Enabling FileVault"
  sudo fdesetup enable
else
  echo "- FileVault is already enabled."
fi

# Check System Integrity Protection (SIP) status
echo "- Checking System Integrity Protection (SIP) status"
sip_status=$(csrutil status)
echo "- SIP Status: $sip_status"
if [[ "$sip_status" == *"disabled"* ]]; then
  echo "- System Integrity Protection is disabled. To enable, restart in Recovery Mode and run 'csrutil enable'"
fi

echo "- Privacy Protection Script Complete"