Leaving Your Mac at the Table: Theft, Snooping and Hands on the Keyboard, Which Lock Covers Which, and When to Keep the Screen On

You are in a café or a coworking space, a build or an agent run is in progress, and you need the bathroom, the counter, or the printer two rooms away. The laptop stays. What should it be doing while you are gone? Most people do one of three things: nothing, close the lid, or press the lock-screen shortcut and hope the job survives. Each is wrong in a different way. This post is an honest look at what you are protecting against when you step away from a Mac in a public or shared space, which tool covers which risk, and where a visible-but-locked setup fits.

Three different risks, often confused

Step away from an open laptop and you are exposed to three things that get lumped together as "security":

• Theft. Someone picks the machine up and walks out. Nothing on the screen matters; the question is whether they can get into the device later.
• Shoulder-surfing and screen snooping. Someone reads what is on the display: a Slack thread, an email, a repository name, a customer's data in a dashboard.
• Hands on the keyboard. Someone, maliciously or just curiously, types into your session: closes a window, sends a message from your account, approves a prompt, runs a command in a terminal that is already authenticated to your infrastructure.

The important thing about these three is that no single action covers all of them, and the one people reach for by instinct, the lock screen, covers two while quietly breaking the thing you stepped away from.

What the macOS lock screen does and does not do

⌃⌘Q, a hot corner, or closing the lid puts the Mac behind the login screen. Against snooping it is complete: the display blanks. Against hands-on-keyboard it is complete too, as long as your password is good and nobody knows it. Against theft it is the single most important layer, because FileVault plus a locked session means a stolen Mac is a brick rather than a data breach.

What it does not do is keep your work visible or, in the lid-closed case, keep it running. A blank screen means you cannot glance back from the counter and see whether the agent is waiting on you. A closed lid means the Mac may sleep, and a sleeping Mac pauses the build, drops the SSH session and, if an agent was mid-task, leaves it wherever it got to. Our overnight checklist covers the sleep side in detail; the short version is that the lid is not a lock, it is an off switch with a delay.

What a visible-but-locked setup adds

VibeLock exists for the gap between "lock everything and see nothing" and "see everything and lock nothing". When you lock with it, the display stays awake, the apps you allow stay visible, everything else is hidden and kept hidden, and a system-wide input firewall swallows keys, clicks, scrolls and gestures. Spotlight, Force Quit and ⌘Q are blocked, so the running agent cannot be killed from the keyboard. Unlock is Touch ID or your Mac login password typed into VibeLock, verified locally. The first post on this site, how to lock the keyboard but keep the screen on, explains why macOS has no built-in equivalent.

Mapped onto the three risks: it covers hands-on-keyboard completely. It covers snooping partially, and this is where honesty matters. The apps you leave visible are, by definition, visible, so if the terminal on screen shows a customer name or a secret in a log line, a passer-by can read it. VibeLock hides everything you did not allow, including desktop files and fullscreen apps on other Spaces, but it cannot hide what you chose to show. And it does not address theft at all: a locked-input Mac is still a Mac someone can pick up. Nothing that runs in software stops that.

A decision rule for the café

The question to ask before you stand up is: do I need to see this while I am away?

• No, and nothing is running. Press ⌃⌘Q and take the laptop with you if you will be gone more than a minute. This is most trips.
• No, but a long job is running. Lock the screen with the lid open, and make sure the Mac will not sleep while locked. The display will blank, the job continues, and you check it when you are back.
• Yes. An agent that will need a permission answer, a deploy you want to watch for a red line, a dashboard a colleague at the next table is also watching. Lock inputs with the screen on, allow only the one app that needs to be visible, and first scroll or clear anything on that screen you would not want read by a stranger.

The third case is narrower than it sounds. It is not "I use agents"; it is "I need eyes on this one right now and I am stepping ten metres away". For the broader argument about why an unlocked Mac with an authenticated agent on it is a problem in the first place, the unlocked laptop post makes the case; this post is about the practical choice at the table.

Before you lock: a thirty-second screen check

Because what stays visible stays visible, the habit that matters most is a glance at the screen before you lock it:

1. Is there anything in the visible terminal or window you would not show a stranger? Scroll it off, clear it, or switch to a view that only shows progress.
2. Is the visible app set to watch-only? VibeLock has two trust levels per app; visible while locked, the one to use here, means the app can be seen but not touched. Accessible while locked lets one app be used, which is for the specific case covered in the colleague-approval post and not for a café.
3. Is the Mac plugged in or well charged? A visible-but-locked screen at full brightness for twenty minutes is a battery cost; dim it before locking if you can still read it from where you will be.
4. Is this a place where you can see the laptop from where you are going? If not, the right answer is the lock screen and the laptop in your bag, whatever is running.

The theft question, directly

Because it comes up every time: no lock of any kind, built-in or third-party, prevents someone taking the machine. What you can control is what they get. FileVault on, a strong login password, Find My enabled with Activation Lock, and a session that is locked rather than merely input-blocked when you are out of sight. VibeLock does not replace any of that and does not claim to. Its job is the forty seconds at the counter when you can see your laptop, the agent is about to ask you something, and you do not want the person behind you answering it.

Summary

Out of sight: lock screen, lid open if something is running, laptop in the bag if nothing is. In sight and needing a glance: inputs locked, screen on, one app visible, screen checked first. VibeLock is a $10, one-time, 2 MB native menu bar app for macOS 13 or later that handles the second case; it is signed and notarized, makes no network calls and needs only the Accessibility permission that input blocking requires. It will not stop a thief, and the post would be dishonest if it ended any other way.