Gatekeeper checks that software downloaded from outside the App Store comes from an identified developer, is notarized by Apple and has not been modified. It also asks for your approval the first time a downloaded app opens. It is a useful filter, and it is not a promise that an app is safe.
What Apple says it does
Apple's platform security guide says Gatekeeper helps ensure only trusted software runs on a Mac. For software from outside the App Store, it checks three things: that the developer is identified, that the software is notarized, and that it has not been modified. It asks for user approval before a downloaded app opens for the first time, and it tracks the provenance of files that downloaded software writes.
Apple describes notarization as a check that the software is free of known malicious content. The word known matters. Notarization catches what Apple's pipeline can detect. It does not review whether an app does what its marketing says.
Gatekeeper also opens apps from randomised, read only locations, which helps stop plug-ins shipped alongside an app from loading automatically. Users and organisations can restrict software to the App Store or override the policy, and Gatekeeper can be turned off entirely.
Why it matters on a developer machine
Developers install a lot of unusual software: CLIs, command line tools downloaded with curl, open source apps, build tools. Many of these arrive as scripts or binaries that do not go through the Gatekeeper prompt in the same way as a double clicked app. Do not assume the operating system is checking everything you run.
A practical habit
When you install a tool:
- Get it from the maintainer's own site or a source you trust. Not from a search ad.
- Verify the checksum when one is published. See verify a SHA-256 checksum before installing.
- Read install scripts before piping them to a shell. An example is reading the Safeguard CLI installer first.
- Read the Gatekeeper prompt. If it says the developer cannot be verified, stop and ask why.
- Do not turn Gatekeeper off because one tool is awkward. Make a one time exception for that tool.
What Gatekeeper does not do
- It does not check what a trusted, notarized app does after launch.
- It does not cover dependencies you pull with a package manager.
- It does not replace keeping software updated.
If an app you trust is later found to be malicious, the check at install time will not help you. Updates and inventory do.
For teams
Decide whether staff may override Gatekeeper, and how exceptions are recorded. If you use device management, it can enforce the policy. Keep a short approved tools list so people have an easy path that does not involve disabling protections.
Quick check
Does notarization mean an app is safe?
No. Apple describes it as a check for known malicious content. It does not vouch for everything the app does.
Sources
Last reviewed: 19 October 2026.
