I made App Trust Preview - a Mac app that explains whether a downloaded .app looks reasonable to open
I'm the developer of App Trust Preview, a macOS utility that explains what macOS can verify about an app before you open it.
Website: https://apptrustpreview.com
Mac App Store: https://apps.apple.com/app/apple-store/id6767974737
macOS: 10.13+
Why I made it
I often see people ask whether a specific Mac app is safe to open, especially when it is open source or distributed outside the Mac App Store. The usual answer quickly becomes technical - check the signature, check sandboxing, check entitlements, understand what permissions mean, inspect helpers, look at what macOS can and cannot enforce.
That information matters, but most users should not need to learn the whole macOS security model just to decide whether opening an app looks reasonable.
App Trust Preview is my attempt to make that first check simple - select an app, press Space for Quick Look, or drop it into the main window, and get a readable report that explains the important signals.
The main idea
A strong Mac app should be easy to understand from the outside.
One of the best signals is a fully sandboxed app with no network entitlement. In plain language, that means the app is running with very limited access. It cannot freely browse your files, talk to the internet, or reach around the system unless macOS grants specific permission. Apple's App Sandbox is one of the strongest protections macOS has against damage from malicious apps, buggy apps, and exploited apps.
But sandboxing is not the whole story. A sandboxed app can still declare that it may ask for access to your camera, microphone, contacts, calendar, photos, Bluetooth, local network, USB devices, or automation of other apps. Those permissions may be normal for some apps and suspicious for others. A video editor asking for microphone access makes sense. A basic text editor asking for microphone access deserves a closer look.
App Trust Preview surfaces those declarations in plain language so you can notice when an app asks for capabilities that do not match what it appears to do.
What App Trust Preview checks
App Trust Preview inspects a .app bundle locally and shows a report about its macOS security signals.
It checks:
- Code signing status
- Developer identity and Team ID
- Bundle identifier and version
- App Sandbox status
- Hardened Runtime status
- Certificate revocation status
- Declared privacy access
- Network and file access entitlements
- Apple Events and automation capabilities
- App groups, Keychain groups, iCloud, associated domains, and related capabilities
- Internal helpers, nested apps, app extensions, XPC services, frameworks, dynamic libraries, and plug-ins
- Signing and sandbox status of internal executable components
The report opens with a plain-language verdict such as whether the app looks reasonable to open, needs caution, or has stronger reasons to think twice.
Why internal components matter
A main app can look safe at first glance because it is sandboxed, while still shipping internal helper tools or nested components that are not sandboxed. That matters because those helpers may be able to do more than the main app can.
App Trust Preview is designed to bring that kind of finding to the top of the report. If a sandboxed app contains unsandboxed helper programs, unsigned components, or internal tools with broader access, the report explains why that matters.
This is also visible in Quick Look, so you can select an app in Finder, press Space, and immediately see the important signals without opening the full app.
Quick Look support
The app includes a Quick Look extension.
You can:
- Select a
.appbundle in Finder - Press Space
- See a compact security preview before opening the app
That is the feature I personally wanted most - App Trust Preview lets you copy the app's bundle identifier from Quick Look. That makes it easy and fast to select an unfamiliar app in Finder, press Space, copy its bundle ID, and search for more information about where it came from before opening it.
What it is useful for
- Checking a downloaded Mac app before opening it
- Seeing whether an app is sandboxed
- Seeing whether an app declares network access
- Seeing whether an app may ask for sensitive permissions
- Checking whether helper tools inside the app are signed and sandboxed
- Understanding why a signal matters without reading code-signing output
- Exporting a report for bug reports, IT review, support, or personal records. You can share it with someone who can help decide whether the app is reasonable to open
Reports can be exported as:
- PNG image
- JSON
- Plain text
What it does not do
App Trust Preview is not antivirus.
It does not guarantee that an app is safe or malware-free. It does not run behavioral analysis. It does not execute the inspected app.
The goal is narrower and more honest - show macOS security signals that can be verified from the app bundle on disk, then explain those signals in plain language.
Privacy
Everything happens locally.
- The Mac app sends no network requests of its own
- Inspected apps are never uploaded
- Inspected apps are never launched
- Inspected apps are never modified
- Reports are generated on your Mac
Certificate revocation is checked through macOS's own trust system.
App Trust Preview itself follows the same security idea it reports on: it is sandboxed and has no network entitlement. It cannot broadly access your Mac. It can inspect only the app bundles you choose.
Comparison
I am a big fan of Apparency. It is a free app distributed outside the Mac App Store and exposes a lot of technical details about app bundles.
For me, Apparency is useful, but it is also very technical. If someone does not already know what Hardened Runtime, entitlements, sandboxing, signatures, and provisioning profiles mean, it can be hard to interpret. Even as a technical user, I often had to dig through several areas to find the specific signals I cared about.
There is another practical difference - internal-component risk is not always brought to the top in a way that is obvious from Quick Look. A main app can be sandboxed, but some helper inside it may not be. To understand that, you often need to open the full tool and inspect what is inside manually.
App Trust Preview is built around surfacing those findings immediately. If the main app is protected but an internal helper is not, the report says that clearly.
App Trust Preview is my attempt to make a different kind of tool:
- Available on the Mac App Store
- Focused on plain-language explanations
- Designed for fast checks before opening downloaded apps
- Includes Quick Look preview from Finder
- Lets you copy the bundle identifier directly from Quick Look for quick research
- Shows both positive and caution signals
- Brings important internal-component findings to the top
- Still includes advanced details for users who want them
I do not see it as a replacement for every technical tool. I see it as a readable pre-open report for normal Mac users and technical users who want faster triage.
Developer information
I am not hiding behind a company name or anonymous account. My name is Ihor July, and you can find my other projects by searching for "Ighor July".
I am also the developer of DockLock Lite, my first-of-its-kind macOS tool for locking the Dock to a chosen display.
And I made Parall, my second first-of-its-kind macOS tool for launching Mac apps with different accounts at the same time.
My background is cybersecurity, bug bounty research, indie development, and native app development. I hack for good and help large companies find and fix security issues. Reverse engineering has always been a lot of fun for me. Now I am applying the same mindset to macOS itself: finding long-standing workflow limitations, hacking around them cleanly, and turning those solutions into Mac apps.
App Trust Preview was built to solve my own need first. More broadly, my main work is building first-of-its-kind Mac utilities that solve specific problems Apple does not solve directly. Buying any of my apps helps me keep working on that full time.
I mostly work with C++, Qt, Objective-C, and macOS internals.
I have a strict principle for local utility apps - software that performs local actions should never connect to the internet without an explicit user action. This principle is applied across my apps.
Social profiles:
- Medium: https://ighor.medium.com
- LinkedIn: https://linkedin.com/in/ighor
- HackerOne: https://hackerone.com/ighor
AI note
None of my apps are vibe coded. I use AI only as a support tool for bug research, typo detection, code completion, and translations. I also use AI to translate my apps into supported languages, including English, since English is not my native language.
Price
App Trust Preview is $2.99 on the Mac App Store.
Website: https://apptrustpreview.com
Mac App Store: https://apps.apple.com/app/apple-store/id6767974737
I would appreciate feedback from r/macapps users, especially on the report wording, screenshots, and whether the explanations are clear enough for non-developers. I am also open to feature requests and would be happy to implement useful suggestions.