How macOS actually works

Sandboxing, and what it costs

Updated 2026-07-31 · 4 min read

It is not laziness or fee avoidance. Some apps are technically impossible to ship on the App Store, and file search is one of them.

The sandbox rule

Every Mac App Store app must be sandboxed: confined to its own container, able to touch only what the user explicitly opens or drags in.

That is excellent for most software and fatal for a few kinds:

• File search that indexes everything — cannot read the filesystem unprompted
• Backup tools — same problem
• Window managers and automation tools — need system-wide events
• Developer tooling — needs to run other processes

What direct distribution means

An app outside the App Store is signed with a Developer ID certificate and notarised by Apple — uploaded, scanned for malware, and issued a ticket that is stapled to the download.

Gatekeeper checks that ticket on first launch. So the app is still identified and still checked by Apple; it is not reviewed for content, and it is not sandboxed.

How to judge one

• Is it signed and notarised? Right-click → Open should not produce a scary warning. From

the Terminal: spctl --assess --type install --verbose=2 /path/to.pkg should say source=Notarized Developer ID.

• Does the developer explain the permissions they ask for?
• Does it make network requests it does not need? Little Snitch will tell you.
• Is there a real refund policy and a person answering support?

The trade you are making

App Store: reviewed, sandboxed, easy refunds, limited capability. Direct: full capability, notarised but not reviewed, and you are trusting the developer more directly.

For a tool whose entire purpose is to see every file on your disk, the second is the only option that can exist.

Common questions

Are non-App-Store Mac apps safe?

Notarised apps have been scanned by Apple for malware. That is a lower bar than review, so the developer's reputation matters more.

How do I check an app is notarised?

spctl --assess --type install --verbose=2 <file> — look for source=Notarized Developer ID.