App Trust Preview - Check Apps before opening

[IGHOR]

I made App Trust Preview, a Mac app that helps you understand Mac software before you open or install it.

It performs static analysis of Mac apps, installer packages, disk images, executable files, and readable scripts. Instead of showing raw developer output, it explains in plain language what macOS can verify about the software, which protections it uses, what access it may request, and which findings deserve a closer look.

The goal is simple. Give you useful evidence before you decide whether opening or installing something looks reasonable.

How you can use it​

• Drop a supported file onto the app or choose one from Finder
• Select a supported file in Finder and press Space to inspect it with the included Quick Look extension
• Open several reports at once in separate windows
• Choose which report sections are visible and change their order
• Export reports for sharing or automation

Local analysis without launching the software​

The inspected file stays on your Mac.

• App Trust Preview never uploads the inspected file
• It never launches or modifies the inspected app, package, disk image, executable, or script
• It does not grant or revoke permissions
• The app makes no network requests for its analysis
• Certificate revocation status is provided by macOS's own trust service
• Optional VirusTotal links open only when you choose them

A readable verdict and the evidence behind it​

Each report begins with one of four clear summaries.

• Strong safety signals
• A few things to know
• Some signals are weaker than usual
• Not enough information

The report then explains the evidence it found, including the following details when available.

• Signing identity, developer name, Team ID, bundle identifier, and version
• Notarization status and whether a ticket is attached for offline verification
• Sandboxing, Hardened Runtime, and important entitlement warnings
• Prominent warnings when software can load unvalidated third-party code or use unsigned executable memory
• Warnings for development builds that allow debugger attachment or use development push notifications
• Privacy permissions the software may request and whether saved decisions match the inspected build
• Internet access declared by the app
• Quarantine and download-related information
• Signing and sandbox status of bundled helpers and other components
• Detected technologies such as AppKit, Chromium, Electron, Flutter, Qt, SwiftUI, Java, and Python when they can be confirmed

Potential network destinations​

App Trust Preview statically searches executables, resources, and other files for domains and URLs. It groups them into categories such as analytics, advertising, crash reporting, updates, cloud services, and social platforms.

These are potential destinations found inside the files, not proof that the app contacted them.

Executable hashes​

Reports include SHA-256, SHA-1, and MD5 hashes for target executables. You can copy a hash or open a VirusTotal lookup with one click.

Privacy permissions in context​

App Trust Preview explains access the software may request, including Camera, Microphone, Location, Contacts, Calendar, Photos, Bluetooth, Apple Events, Screen Recording, Accessibility, Input Monitoring, Local Network, and other sensitive capabilities.

When available, it also shows saved macOS privacy decisions such as Allowed, Denied, Limited, Add-only, Not determined, or Unknown. It indicates whether those decisions match the exact build being inspected.

If an app does not declare a required purpose string in its Info.plist, macOS will refuse that permission. App Trust Preview explains this instead of presenting every permission-related detail as a threat.

Apps, packages, disk images, executables, and scripts​

For installer packages, App Trust Preview can inspect package components, install locations, authorization requirements, install scripts, and contained files when available.

For disk images, it can inspect both the container and a supported app inside it. After installing an app from a downloaded DMG, you can optionally move the DMG to the Trash.

For executable files and readable scripts, reports can include the Mach-O platform, minimum macOS version, SDK, linked libraries, runtime search paths, code-signing details, and a readable script preview.

Checks inside the app bundle​

App Trust Preview checks nested components such as helper tools, nested apps, app extensions, XPC services, frameworks, dynamic libraries, and plug-ins.

Each component is checked for signing and sandbox status. This can reveal an important distinction that simpler tools miss, such as a sandboxed main app that contains an unsandboxed helper. Important entitlement warnings include the path of the affected component.

Power users can also inspect certificate chains and fingerprints, CDHashes, designated requirements, provisioning profiles, Mach-O architectures, linked libraries, entitlements, quarantine status, private API indicators, package contents, and script previews.

Command line and report exports​

Reports can be exported as PDF, PNG, JSON, or plain text. The command line interface exports JSON or text for scripts, support workflows, security reviews, and AI-assisted analysis.

Run the following command to see the current options.

"/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview" --help

For example, this prints a JSON report for an app.

"/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview" --export json --target "/path/to/App.app"

The command line uses the same local inspection system and includes the same security findings as the app. An AI agent can read the exported report without requiring you to upload the inspected software itself.

Open with the apps you choose​

Add antivirus scanners, disk image utilities such as EasyDMG, editors, or other compatible tools to the report view. You can then open the analyzed target in any of them with one click.

Keep a personal note for each app​

Record why you trust an app, where it came from, which permissions you approved, or what you want to check after an update. Notes save automatically and appear in App Trust Preview and Quick Look.

What App Trust Preview does not claim​

App Trust Preview is not antivirus software and cannot guarantee that something is safe or malware-free. It presents security signals that can be verified from files on disk and explains what those signals mean in practical terms.

You do not need to understand Hardened Runtime, entitlements, Mach-O metadata, or code-signing output. App Trust Preview explains what the software may access, which macOS protections are present, and where you may want to investigate further.

You can find App Trust Preview in the Mac App Store or visit https://apptrustpreview.com

 

[bogdanw]

Saying "Use caution" "The main app is not sandboxed" for Firefox is a bit misleading.
https://wiki.mozilla.org/Security/Sandbox#OSX

 

[IGHOR]

Thanks for the feedback!

I agree, Firefox is a good example where the wording needs more nuance.

What the app currently means is: Firefox is not using Apple’s App Sandbox entitlement. That does not mean Firefox has no sandboxing at all, because browsers can have their own process sandboxing model.

I am open to feature requests and wording improvements. What wording would you expect here so it is technically accurate but not misleading for apps like Firefox?

 

[bogdanw]

In my opinion, if an app is signed and notarized by Apple, it should be considered safe to open.
The rest should be presented as additional information.

 

[IGHOR]

In my opinion, if an app is signed and notarized by Apple, it should be considered safe to open.
The rest should be presented as additional information.

App Trust Preview can say an app looks safe to open, but not because it blindly trusts the developer or notarization. It says that when the app is packaged with strong limits, for example sandboxed, no broad network access, and no risky internal helpers. Warnings are not "this app is dangerous" flags. They are things the user may want to read before deciding.

 

[turbineseaplane]

How much AI was used to make this App?



I think that should always be disclosed now.

 

[IGHOR]

How much AI was used to make this App?

Very little AI was used in the actual app.

The idea is my own. I have been making apps since 2008, and App Trust Preview is native macOS software built on top of my own reusable library that I have developed over the years and use across my apps. That shared foundation is also one reason I can support older macOS versions instead of depending only on newer system APIs.

I use AI as a support tool for bug research, typo detection, code completion, translations, localization, and sometimes early UI direction sketches. English is not my native language, so AI is also helpful for wording.

The app itself is not vibe coded. The concept, product decisions, implementation, debugging, native UI work, and release are mine.

 

[bogdanw]

App Trust Preview can say an app looks safe to open, but not because it blindly trusts the developer or notarization. It says that when the app is packaged with strong limits, for example sandboxed, no broad network access, and no risky internal helpers. Warnings are not "this app is dangerous" flags. They are things the user may want to read before deciding.

By your criteria, Malwarebytes with network access, two launch daemons and a launch agent is really not safe 🙂

Ignore my opinions, I’m not a customer and never will be. I use free software https://www.mothersruin.com

 

[IGHOR]

By your criteria, Malwarebytes with network access, two launch daemons and a launch agent is really not safe 🙂

I understand why it reads that way. The app does not have a "not safe to open" label. It shows "safe to open" only when the app is strongly limited, then uses warnings for everything else that deserves attention. Malwarebytes is exactly the kind of app where network access and background components are expected, so the warning is not "this is unsafe". It is "this app can do more, make sure that matches what you expect from it."

 

[IGHOR]

Ignore my opinions, I’m not a customer and never will be. I use free software https://www.mothersruin.com

I am also a big fan of Apparency. It is a free app distributed outside the Mac App Store, and it exposes a lot of technical details about app bundles.

For me, Apparency is useful, but it is still a technical inspection tool. If someone does not already understand Hardened Runtime, entitlements, sandboxing, signatures, and provisioning profiles, it can be hard to interpret what actually matters.

App Trust Preview has a different focus. It tries to bring the important signals to the top and explain them in plain language. For example, a main app can be sandboxed while still shipping internal helper tools that are not sandboxed. That kind of difference matters, because a helper may be able to do more than the main app can. App Trust Preview highlights that directly instead of making the user dig through internals manually.

The Quick Look preview is also a big part of the difference for me. You can select an app in Finder, press Space, immediately see important signals, see which privacy permissions the app may request, and copy useful identifiers like the bundle ID for quick research. Apparency is great, but its Quick Look preview does not show the app's possible permission requests or provide that kind of quick copy workflow.

I am also open to feature requests, and I am already working on more features that go beyond what Apparency currently does.

 

[gilby101]

Giving an opinion on other apps is tricky. For example, I started by inspecting Apparency for which you give: "High Caution. Strong reasons to think twice". Seems a bit harsh.

I have now looked at lots of the apps I have installed. A few are "High Caution", the rest are "Caution". And that includes apps from Apple, like Pages and Mail. I am sure you are right to say we should by cautious installing apps, but your app is likely to spread alarm and confusion.

At last I have found an app wth green: "Strong. Looks safe to open." At that was (drum roll): App Trust Preview.

Just because app needs entitlements, etc. to do its job doesn't make it untrustworthy.

I applaud the attempt to make something that is understandable by the non-techo, but to me your app doesn't do that. It would leave me worried about perfectly good apps and not being able to understand why.

From usability perspective, I found the QuickLook preview far too slow when using Finder's column view. I reverted that to Apparency.

For me, worth the 5 AUD for an interesting app for inspecting other apps. Gives me another view of apps. But I could not recommend it to anyone who didn't already have some understanding of the technicalities of macOS app protections.

The goal is simple: help you decide whether opening an app looks reasonable.

Sorry to say it fails that unless you understand all the detail.

 

[IGHOR]

Sorry to say it fails that unless you understand all the detail

Thank you for the detailed feedback. This is genuinely useful.

There is no special exception for App Trust Preview in the analysis. It goes through the same checks as any other app.

It shows as safe because of the actual bundle signals: it is sandboxed, has no network entitlement, is signed, and its certificate is not revoked. In other words, it is packaged in a way that strongly limits what it can do on the system.

I agree that if too many legitimate apps end up as "Caution" or "High Caution", the result can become confusing instead of helpful. That is not the goal. The goal is to turn macOS security signals into human-readable context, not to make users afraid of normal apps that need specific access to do their job.

Apparency will probably remain a little faster in Quick Look because it appears to do a lighter preview there. App Trust Preview checks internal components in Quick Look too, including helpers, extensions, frameworks and signing/sandbox state. That gives more context, but it also means more work before the preview is ready. I am still optimizing that path.

I am already working on improving the verdict logic, wording, and signal weighting so the app better distinguishes between "this is expected for this kind of app" and "this deserves closer review". I am also working on Quick Look performance.

I am open to feedback and feature requests. I will continue improving the app so the implementation better matches the main idea: clear, understandable pre-open signals for normal users, with enough detail for technical users.

I am also working on more features that are not currently available in Apparency. Feedback like yours helps me see what needs to be fixed first.

 

[IGHOR]

Giving an opinion on other apps is tricky. For example, I started by inspecting Apparency for which you give: "High Caution. Strong reasons to think twice". Seems a bit harsh.

I released fixes based on lots of feedback from the community. Please update and try v1.1.0. Let me know what you think now. I improved the speed as well.

 

[gilby101]

I released fixes based on lots of feedback from the community. Please update and try v1.1.0. Let me know what you think now. I improved the speed as well.

Thanks for the update. It is certainly improving. I do like the depths to which you analyse each app, and that is genuinely useful to those who know something about macOS app structure and protections that Apple puts in place. For the non-techie, I am not so sure.

 

[IGHOR]

For the non-techie, I am not so sure.

What in your opinion could do it better for that purpose?

 

[gilby101]

The non-techie only needs to know if it is trustworthy or not (whatever trustworthy means). For that they rely on apps in App Store have been vetted by Apple and so, by definition, are considered trustworthy. I don't think the non-techie wants to be told to review the details.

To give advice about an app you need to understand the purpose of the app and whether the privacy settings are reasonable given its purpose. That sounds like a lot of work!

For me (15 year retired IT with security interests), you do expose lots of fascinating stuff about apps with a broader scope than Apparency.

Ignore my opinions, I’m not a customer and never will be. I use free software https://www.mothersruin.com

I think you might to take a closer look. The approach is very different to Apparency.

 

[bogdanw]

I think you might to take a closer look. The approach is very different to Apparency.

I understood that, but I don't need App Trust Preview.

I have a question, the latest images from the app's App Store page show for Chrome "Can ask to use the camera - Denied" & "Can ask to use the microphone - Allowed".
Are those read from Chrome's settings or from TCC?

 

[IGHOR]

Are those read from Chrome's settings or from TCC?

It reads from TCC

 

[bogdanw]

It reads from TCC

That should require Full Disk Access for App Trust Preview or the user manually selecting ~/Library/Application Support/com.apple.TCC/TCC.db & /Library/Application Support/com.apple.TCC/TCC.db

 

[IGHOR]

That should require Full Disk Access for App Trust Preview or the user manually selecting ~/Library/Application Support/com.apple.TCC/TCC.db & /Library/Application Support/com.apple.TCC/TCC.db

Yes it does, once granted it is working as you would expect

 

[IGHOR]

For me (15 year retired IT with security interests), you do expose lots of fascinating stuff about apps with a broader scope than Apparency.

You will like the v1.2.0 even more! Check it out.

 

[IGHOR]

App Trust Preview v1.2.0

- Added support for installer packages, disk images, binary executables, and scripts.
- Added a command line interface for exporting reports from a given app, package, disk image, executable, or script. This enables powerful automation workflows and external AI analysis.
- Added a Settings dialog for configuring Quick Look and the main app report view. You can now reorder sections and hide the sections you do not need.
- Added multi-window support, so you can analyze more than one item at the same time.
- Improved the interface, optimized trust signal detection, and fixed multiple report and analysis issues.

 

[gilby101]

You will like the v1.2.0 even more!

Yes, I do. Now I have to explore the CLI.

I am coming to really like your app. 👍

 

[IGHOR]

I am coming to really like your app. 👍

I'm glad to hear that. If you find anything you would like to be added for your personal needs, feel free to ask. I'm open to feature requests.

 

[IGHOR]

App Trust Preview v1.2.2 released!

• Fixed support for legacy macOS versions.
• Added a Hash Lookup report for internal app executables, making it easy to review and copy file hashes.
• Added basic VirusTotal support. From the Hash Lookup report, you can open VirusTotal links to review existing reports for detected hashes.
• Fixed localization issues.