// blog · · by Nathan Baldwin
// Apple scans every notarized Mac app for malware before you download it. What that check covers, what it doesn't, and how to verify any app yourself.
When you first opened Bitaxe Baller, macOS didn’t show you the “unidentified developer” warning — it just opened. That’s not luck. Every release of the app gets uploaded to Apple’s servers, scanned for malware, and cryptographically stamped before you ever download it. The process is called notarization, and Apple has required it for apps distributed outside the Mac App Store since macOS 10.15 Catalina, with full enforcement starting February 2020.
If you’re running mining software on the same machine where you keep wallet keys or exchange logins, you should care how this works — and know exactly where its guarantees stop.
Notarization is an automated malware scan run by Apple, not a human review. The developer builds the app, signs it with a Developer ID certificate (which requires a paid Apple Developer account at $99/year), and submits the binary to Apple’s notary service. Apple’s systems scan it for known malware, check the code signature, and confirm the app uses the hardened runtime — a stricter execution mode that blocks code injection and unsigned plugin loading.
Most submissions come back in under five minutes. If the scan passes, Apple issues a ticket: a signed statement saying “we scanned this exact binary and found nothing malicious.” The developer staples that ticket to the app before shipping it, so your Mac can verify it even offline.
Then Gatekeeper does the enforcement on your end. When you download an app through a browser, macOS attaches a quarantine flag (com.apple.quarantine) to the file. On first launch, Gatekeeper checks the signature and the notarization ticket. Valid ticket: the app opens with a simple confirmation. No ticket: you get the scary dialog, and on current macOS versions an unsigned app won’t open at all without a trip to System Settings.
Worth being precise here, because “notarized” gets thrown around as if it means “Apple approved.”
What the notary service verifies: the binary contains no malware Apple knows about, the code signature is valid and tied to a real, identifiable developer account, the hardened runtime is enabled, and the binary hasn’t been modified since signing. One byte changes, the signature breaks, Gatekeeper refuses to run it.
What it does not verify: that the app works, that it’s well written, that it respects your privacy, or that it does what the developer claims. There’s no App Store-style human review. A notarized app could still phone home with telemetry or be badly built — it just can’t contain known malware or hide who published it.
That second part is the real value. Notarization ties every binary to a legal identity with a paid developer account. If a notarized app turns out to be malicious, Apple revokes the certificate and every copy on every Mac stops launching. That kill switch has been used — most notably against variants of the Shlayer adware family, which briefly slipped through notarization in 2020 before Apple revoked them within days.
Mining tools are a favorite disguise for actual malware. The pattern is old: wrap a credential stealer in something miners already expect to be a little sketchy — a “tuning utility,” a “firmware flasher,” an “optimized miner” — and rely on users being trained to click past security warnings. If you’ve ever typed xattr -d com.apple.quarantine on a random download because a forum post told you to, you’ve felt that training in action.
A dashboard app like Bitaxe Baller has network access to every miner on your LAN and talks to the AxeOS API on each one. That API can change pool settings — which means the wallet address your hashrate pays out to. Software with that reach should clear the highest trust bar available on the platform, not ask you to bypass the checks.
Notarization doesn’t make an app trustworthy by itself. But it does mean the binary you downloaded is byte-for-byte what the developer shipped, scanned by Apple, and traceable to an accountable identity. For open source software it stacks with a second guarantee: you can read the code on GitHub and confirm the notarized build behaves the way the source says it should.
Don’t take any of this on faith — check it. Open Terminal and run this against any app:
spctl -a -vv /Applications/Bitaxe\ Baller.app
A notarized app returns accepted with source=Notarized Developer ID. Then confirm who signed it:
codesign -dv --verbose=2 /Applications/Bitaxe\ Baller.app
Look at the Authority lines. You should see the developer’s name and Team ID, chained up to Developer ID Certification Authority and then Apple’s root. You can also confirm the ticket is stapled to the app bundle:
xcrun stapler validate /Applications/Bitaxe\ Baller.app
The validate action worked! means the notarization ticket is attached and your Mac can verify it offline. Run these three commands on anything that touches your miners or your keys. Ten seconds per app, and you never have to wonder whether a download was tampered with between the developer’s machine and yours.
Bitaxe Baller ships on Windows too, and Windows has a rough equivalent: Authenticode code signing plus Microsoft SmartScreen. The mechanics differ — there’s no mandatory malware scan before distribution, and SmartScreen leans on download reputation, which means even legitimately signed apps from small developers can trigger the “Windows protected your PC” screen until enough people have installed them. Signing certificates are also pricier and messier: an OV certificate runs a few hundred dollars a year, and EV certificates that skip SmartScreen’s reputation period cost more and require hardware tokens. Same goal as notarization, weaker guarantees, more friction for small developers. If a signed Windows app from an indie developer throws a SmartScreen warning, that’s the reputation system working as designed — check the publisher name on the “More info” link before you run it.
Next time you install anything that touches your mining fleet, spend the ten seconds: run spctl -a -vv on the app bundle and confirm source=Notarized Developer ID before you launch it. And stop stripping quarantine flags with xattr to silence Gatekeeper — if an app needs that to run in 2026, the developer either couldn’t or wouldn’t clear a $99 bar that exists specifically to protect the machine your miners answer to.
Try it yourself: Bitaxe Baller is a free desktop app for Mac and Windows that surfaces these recommendations automatically across your fleet — live monitoring, tuning suggestions, pool config, all in a native window. Open source on GitHub.