Is Boring Notch safe? What its README states
This page answers “is Boring Notch safe” by listing what the project’s own pages say, and what they leave out. This page does not rate the app. Its README, read on 5 November 2026, says it is free, has no Apple Developer account yet, and needs a workaround to open the first time. It states no permissions and no data policy. The source is public under GPL 3.0, so you can check the rest yourself.
What the README says
The table below only repeats what the project’s GitHub page and README state. “Not stated” means the page does not say, which is different from “no”.
| Question | What its pages state |
|---|---|
| Who makes it | The repository belongs to the TheBoredTeam organization on GitHub. The README names no individual maintainer. It credits others for the icon and the website. |
| Open or closed source | The repository page lists the GPL 3.0 license. The README body does not set out the terms. |
| Price | Not stated as a price. The README links a Ko fi page for voluntary support. |
| Signed by a Developer ID | The README says the project has no Apple Developer account yet. It does not mention signing. |
| Notarized by Apple | Not stated. |
| Permissions it needs | Not stated. |
| Data it collects | Not stated. No privacy policy is linked from the README. |
| Refunds | Not applicable to a free download, and not stated. |
| macOS needed | macOS 14 Sonoma or later, on Apple silicon or Intel. |
The project’s website, theboring.name, showed only a title line when read on 5 November 2026, so it adds nothing to this table.
How you open it the first time
Because the README says there is no Apple Developer account, macOS shows an unidentified developer warning. The README gives three ways round it:
- A Terminal command,
xattr -dr com.apple.quarantine "/Applications/Boring Notch.app", which the README recommends and says works for all users. - Open the app, click OK on the warning, then use Open Anyway in System Settings under Privacy & Security. The README says this does not work for all users.
- Install with Homebrew using
brew install --cask TheBoredTeam/boring-notch/boring-notch. The README says this avoids the warning.
Apple has its own advice on this. Its page on opening an app from an unidentified developer says apps that Apple has not reviewed trigger the warning, and that overriding security settings is a common way Macs get infected with malware. It says the safest options are the Mac App Store or an alternative app. That is Apple’s general advice, not a statement about Boring Notch. Whether to proceed is your call, and the checks below help you decide.
What the open source license gives you
A public repository means anyone can read what the app does. The README credits two outside projects, MediaRemoteAdapter for Now Playing and NotchDrop for the original shelf, so part of the code is built on other open projects. The release notes on GitHub mention fixes to update signing and updater security in some versions. They do not mention notarization or telemetry. The pages state nothing either way about whether anyone has audited the code, so do not assume it.
A closed source app such as NotchStar gives you no source to read. The trade is a signed and notarized download from one developer. Open source can be checked by people with the skills, but a build you download is a separate thing from the source on GitHub. You can build it yourself from the repository if you want to be sure what you run.
Checks you can run yourself
- Ask macOS what it thinks of the app. After installing, run
spctl -a -vv "/Applications/Boring Notch.app"in Terminal. The answer isacceptedorrejected, with a source such as Notarized Developer ID. The README says there is no developer account, so a rejection would match what the README says. The project may change this, so run the check on your copy. The result describes how macOS views the download, not whether the code is harmful. - Read the permission list in System Settings. Open Apple menu, System Settings, Privacy & Security. Each category lists the apps that asked for access, and you can turn off any you do not want. Apple’s page for this describes macOS 27 (checked 5 November 2026). Labels can differ on older versions of macOS.
- Watch the network. Because no privacy page exists, use a network monitor such as Little Snitch to see which servers the app contacts. If it contacts none, that is easy to confirm. If it does, you can look the address up.
- Read the code or the issues. Search the repository for network calls, or read the open and closed issues for reports about privacy.
- Verify where the download came from. Use the project’s GitHub releases page or the Homebrew command in its README, not a copy from a third party site.
What this means for a buyer
Boring Notch costs nothing, so there is no payment, license key or account to consider. The open questions are the ones its pages leave blank: permissions, data and signing. If you want a free app and are comfortable with a Terminal command or Homebrew, the README gives you that route. If you would rather double click a notarized app, pick one that states it. If you are unsure, the notch app privacy checklist lists the questions to ask of any app, and Are Mac notch apps safe covers the basics.
How NotchStar compares
NotchStar is closed source. Downloads since version 1.0.3 are signed with a Developer ID and notarized by Apple, there is no account, and nothing is measured unless you say yes to anonymous version info. It asks for four permissions: Calendars, Reminders, Camera and Automation. It costs $4 once with a 7 day trial and a 7 day refund. Prices as of 5 November 2026. Boring Notch wins on price and on readable source, and it replaces the system volume and brightness pop ups, which NotchStar does not. Read the full comparison or the Boring Notch alternatives page. The details are in Is NotchStar safe.
Sources
All pages were read on 5 November 2026.
