Privacy By Default in Tmux is not a feature you stumble into. It is a deliberate choice, engineered into your workflow to guarantee that session data, command output, and environment variables are protected from unwanted access. Tmux—powerful, scriptable, persistent—is often used on shared systems or remote servers. Without a privacy-first configuration, you leave artifacts behind that other users, processes, or logs can read.
A privacy-by-default Tmux setup starts with controlling socket permissions. By default, Tmux creates a socket in /tmp with broad permissions. Change this with:
tmux -S /path/to/secure/socket
chmod 700 /path/to/secure/socket
This ensures only your user can attach to the session. Combine it with set-option -g default-command /bin/bash and avoid inheriting unwanted shell state.
Disable automatic logging in scripts that spawn Tmux sessions. If you require logging for debugging, write logs to directories with restrictive permissions (chmod 700). Prevent environment leakage by using set-environment -g to only pass essential variables into your session. Avoid attach-session commands that execute within open terminals with other observers.
For ephemeral workflows, tmux new-session -d keeps the session detached until you explicitly connect, reducing exposure. Pair this with session name randomization: