Gatekeeper checks that software downloaded from outside the App Store comes from an identified developer, has been notarized by Apple and has not been altered. It asks you before first launch. It tells you the code was checked for known malware, not that it is safe to trust.
What Gatekeeper covers
Apple's platform security documentation says Gatekeeper helps ensure only trusted software runs on a Mac. It covers apps, plug-ins and installer packages downloaded from outside the App Store.
Per Apple, it verifies three things: the software comes from an identified developer, it is notarized by Apple, and it has not been altered.
The first launch prompt
Gatekeeper asks for your approval before downloaded software opens for the first time. Apple says this is in case someone was tricked into running code they thought was a data file. A PDF icon on an executable is the classic version of that trick.
Other behaviours Apple lists
- It tracks where files written by downloaded software came from.
- It opens apps from randomised, read-only locations, to block automatic loading of malicious plug-ins bundled with them.
- Users and organisations can restrict software to the App Store, override policies, or turn Gatekeeper off entirely.
What notarization means
Apple describes the notarization pipeline as designed to confirm that apps contain no known malware, working alongside App Store review. By default, all software in macOS is checked for known malicious content the first time it is opened.
The key words are known malicious content. A notarized app can still be a bad idea, for example a legitimate tool with a vulnerability, or a developer you should not trust. Notarization is a floor, not a verdict.
What this means on a developer Mac
- Do not turn Gatekeeper off to make a build tool run. Approve the specific app instead.
- When a prompt appears for something you did not just download, stop.
- Treat an unsigned or unidentified developer warning as a reason to look at the source, not as an obstacle to click through.
- For tools you build yourself, expect warnings on first run and decide who else will need to run them.
- If your organisation manages your Mac, do not override its policy.
The gap that remains
Gatekeeper judges the app bundle. Much of a developer's risk comes from other places: package manager install scripts, build plugins and code fetched at runtime. Those do not pass through a Gatekeeper prompt in the same way. That is where dependency scanning does its work. Safeguard's free scan at gold.safeguard.sh/scan looks at the dependencies in a repository.
I could not confirm the XProtect details from the page used here, so this post says nothing about them.
Quick check
Does notarization mean an app is safe?
No. Apple describes it as a check that the app contains no known malware. It is not a guarantee of safety.
Can I turn Gatekeeper off?
Apple says users and organisations can turn it off entirely, but doing so removes a useful check.
Sources
Last reviewed: 19 October 2026.
