Raycast

Keyboard launcher replacing Spotlight, with clipboard history, window management, and extensions for Linear, GitHub, Slack.

raycast.com security headers A 90/100

productivity-notes · added 2026-08-11

What it does

Core function	Keyboard launcher and productivity command palette with extensions for multiple services.
Target use case	Individual users seeking fast access to apps, clipboard history, window controls, and third-party integrations.
Integration approach	Acts as a hub, connecting to Linear, GitHub, Slack, and dozens of other services through extensions.
Platform availability	macOS only, designed to replace the native Spotlight launcher.

Pick Raycast if

You want a fast keyboard launcher to replace Spotlight on macOS.
You need clipboard history, window management, and quick access to multiple services in one tool.
You already use Linear (or other tools) and want a unified command palette to interact with them.
You prefer a lightweight productivity layer that sits above your existing apps rather than a standalone platform.
You want a fast keyboard launcher to replace Spotlight and streamline macOS navigation.
You need quick access to clipboard history and window management from the keyboard.

Drawn from the comparisons below: AI-assisted from listing data, not hands-on tested.

Compare

Raycast vs Linear2026-09-12
Raycast vs Obsidian2026-09-12

Security headers: A, 90 out of 100

Number 14 of 95 in the ranking. Missing 2 of the 9 headers we check.

Meets the B minimum (70/100) in our RFP clause.

Missing 2

Cross-Origin-Resource-Policy 0 of 5

Tells browsers which sites may load this site's resources.

Without it: Other sites can pull the product's responses into their own pages, which makes side-channel leaks of what a signed-in user can see easier.
No version disclosure 0 of 5

Keeps the Server and X-Powered-By headers from announcing exact software versions.

Without it: A header like "nginx/1.18.0" or "PHP/7.4" tells an attacker which known vulnerabilities to try, and flags possibly unpatched software to every automated scanner on the internet.

Sent 7

Content-Security-Policy 25 of 25

frame-ancestors 'self' http://localhost:3333 https://cms.raycast.com https://arc.net/folder/;
Strict-Transport-Security 20 of 20

max-age=63072000; includeSubDomains; preload
X-Content-Type-Options 10 of 10

nosniff
Frame protection 10 of 10

CSP frame-ancestors
Referrer-Policy 10 of 10

strict-origin-when-cross-origin
Permissions-Policy 10 of 10

camera=(), microphone=(), geolocation=()
Cross-Origin-Opener-Policy 5 of 5

same-origin-allow-popups

Checked 2026-10-04 at https://www.raycast.com/. Re-checked every 7 days. The grade covers the headers this website sends, not the product’s overall security. How the grade works.