# What is the App Sandbox on Mac?

> The App Sandbox is a macOS feature that limits an app's access to system resources and user data. Learn how it differs from the hardened runtime.

Canonical: https://www.notchstar.com/glossary/app-sandbox/
Last updated: 2026-11-04

Published 2026-11-04.

The App Sandbox is a macOS feature that restricts an app's access to system resources and user data. Apple's stated aim is to contain the damage if an app becomes compromised. Apple says it limits an app's access to the resources it requests through entitlements.

## Why it matters

Apple says that to distribute a macOS app through the Mac App Store, you must enable the App Sandbox capability. Apps distributed outside the store, as NotchStar is, are not required to by that rule.

## NotchStar and the sandbox

NotchStar's entitlements file does not include the App Sandbox key, so it is not sandboxed. It is signed with a [Developer ID](https://www.notchstar.com/glossary/developer-id/), notarized by Apple and uses the [hardened runtime](https://www.notchstar.com/glossary/hardened-runtime/), and it asks for permission to reach the camera, calendars and Apple Events. Its Disk tool never deletes anything: everything goes to the Trash, only inside the home folder and app bundles in /Applications, and scans start only when you press a button.

## Not the same thing

The sandbox and the hardened runtime are separate. The sandbox limits resources an app can reach. The hardened runtime limits how code behaves inside the app.

## Related

Read about [entitlements](https://www.notchstar.com/glossary/entitlements/), the [Disk tool](https://www.notchstar.com/features/disk/) and [is NotchStar safe](https://www.notchstar.com/guides/is-notchstar-safe/).

## Keep reading.

- [What is the hardened runtime?](https://www.notchstar.com/glossary/hardened-runtime/): The hardened runtime is a code signing setting that limits what a Mac app can do. Learn what it blocks and how entitlements relax it.
- [What are entitlements in macOS?](https://www.notchstar.com/glossary/entitlements/): Entitlements are key value pairs signed into a Mac app that grant it permission to use a service or technology. Learn what NotchStar asks for and why.
- [Is NotchStar safe? Signing, permissions and what it sends](https://www.notchstar.com/guides/is-notchstar-safe/): NotchStar is signed and notarized by Apple, needs no account and sends nothing unless you opt in. See every permission it asks for and how to check it yourself.
- [Disk space, duplicates, apps and cleanup](https://www.notchstar.com/features/disk/): See free space, find big folders, duplicates and app leftovers, compress media and clean caches from your Mac notch. Everything goes to the Trash.

## More in Security and signing.

- [What is Gatekeeper on a Mac?](https://www.notchstar.com/glossary/gatekeeper/): Gatekeeper is the macOS check that decides whether downloaded software may run. Learn what it checks, why it shows warnings and how it relates to notarization.
- [What is notarization on Mac?](https://www.notchstar.com/glossary/notarization/): Notarization is Apple's automated check of Mac software before you download it. Learn what Apple says it covers and what it does not.
- [What is an Apple Developer ID?](https://www.notchstar.com/glossary/developer-id/): A Developer ID is the certificate Apple gives developers to sign Mac apps shared outside the App Store. Learn what it proves and what it does not.
- [What is a DMG file?](https://www.notchstar.com/glossary/dmg/): A DMG is a disk image, a single file that opens like a drive. Learn how apps ship in one, how to install from it and how to verify the download.
- [What is the hardened runtime?](https://www.notchstar.com/glossary/hardened-runtime/): The hardened runtime is a code signing setting that limits what a Mac app can do. Learn what it blocks and how entitlements relax it.
- [What are entitlements in macOS?](https://www.notchstar.com/glossary/entitlements/): Entitlements are key value pairs signed into a Mac app that grant it permission to use a service or technology. Learn what NotchStar asks for and why.