Gatekeeper is the macOS feature that decides whether an app is allowed to run the first time you open it. It checks three things in sequence — is the app signed, is the signature valid, and has Apple seen it before — and refuses to launch anything that fails. It is not antivirus. It is an identity check that happens before the app gets to do anything.
The Three Checks
Code signature. Every app built with a Developer ID carries a signature that ties the binary to a certificate. Modify one byte after signing and the signature no longer validates.
Notarisation. A developer can submit an app to Apple, which scans it automatically and issues a ticket if nothing trips. Notarisation is not a review — no human looks at the app — but it means the build was checked against known malware at upload time.
Quarantine flag. Files downloaded through a browser or a mail client get an extended attribute marking where they came from. Gatekeeper only inspects apps that carry this flag, which is why an app you compiled yourself never triggers a warning.
You can see the flag on any file:
xattr -l ~/Downloads/SomeApp.dmgWhy an App Gets Blocked
Four messages cover most cases, and they mean different things:
- “cannot be opened because the developer cannot be verified” — the app is unsigned or signed with a certificate Apple does not trust.
- “is damaged and should be moved to the Trash” — the signature failed to validate. Frequently a transfer problem rather than a broken app.
- “cannot be opened because Apple cannot check it for malicious software” — signed but not notarised.
- “is from the internet” on first launch — the normal, expected prompt.
Opening a Blocked App
On current macOS, right-click or Control-click the app and choose Open, then confirm in the dialog. That is the supported path and it records your decision for that app.
Do not run xattr -d com.apple.quarantine or disable Gatekeeper system-wide
to get past one app. Both remove the check for everything, permanently, and
the second is a system setting that survives until you change it back.
Where Gatekeeper Stops Being Useful
Gatekeeper runs once, at first launch. After that the app can do whatever it does, and nothing re-examines it. An app that was clean when it was notarised and later downloads a payload is not caught by this check.
That gap is what the other tools in the category cover. Malwarebytes scans what is already on the disk. KnockKnock lists what is persistently installed — launch agents, login items, browser extensions — which is where unwanted software lives after it gets in. Our guide to Mac security audit tools covers the rest of that workflow.
The practical rule: let Gatekeeper stop things, but do not treat “it opened” as a verdict on whether it should have.
Frequently Asked Questions
Why does macOS say an app is damaged when it is not?
That message usually means the app's code signature no longer validates — commonly because the quarantine flag survived a transfer that broke the signature, or because the app was modified after signing. It is a Gatekeeper verdict, not evidence of a broken download.
Does allowing an app through Gatekeeper make it safe?
No. Gatekeeper checks identity and notarisation, not intent. An app signed by a real developer and notarised by Apple can still be unwanted — it passed a background check, not a behavioural one.
