"Apple Could Not Verify… Is Free of Malware" on a Markdown App

"Apple could not verify '…' is free of malware that may harm your Mac or compromise your privacy" means the app isn't notarized by Apple, so macOS can't check it. It doesn't mean Apple found malware. To open it anyway, try the app once, then go to System Settings ▸ Privacy & Security and click Open Anyway within about an hour. If the alert says the app is "damaged" instead, clear the quarantine flag in Terminal with /usr/bin/xattr -dr com.apple.quarantine /Applications/AppName.app. Do either only for an app you downloaded from its developer.

This page is about Markdown apps, where I can say which ones trigger the alert and why. I checked every app named here on November 5, 2026, on macOS 26.3, with the same Gatekeeper test macOS runs on downloaded apps. For the two editors that fail it, the comparisons MarkText vs MacMD Viewer and MacDown vs MacMD Viewer list the alternatives.

What the alert means#

Apple's support article Safely open apps on your Mac is the primary source. Since macOS Catalina, an app downloaded outside the App Store has to be signed with a Developer ID and notarized: Apple scans the build for known malware before the developer ships it. When that's missing, Apple says, "macOS can't verify that the app is free of malware."

The same article covers the alerts you may see. Their exact wording varies with the macOS version:

• "Apple could not verify… is free of malware", or on older versions "…cannot be opened because the developer cannot be verified": Apple describes these as the app developer that "cannot be verified" and macOS that "can't verify that the app is free of malware". In my tests both came from an app with no Developer ID or no notarization.
• "…is damaged and can't be opened": macOS "detects that software has been modified or damaged". An unsigned or ad-hoc signed download can land here even when the file is intact: MarkText users report it.
• "…will damage your computer": macOS detected malicious content, or the developer's authorization was revoked. Don't override this one.

Which Markdown apps trigger it#

I downloaded each app from its official source, applied the quarantine flag a browser adds, and ran spctl -a -vvv -t exec, the Gatekeeper assessment.

Homebrew runs the same check. It disabled the mark-text and macdown casks on September 1, 2026, with the reason fails_gatekeeper_check. Two more free apps say in their own README that their builds are notarized, though I didn't run the test on them: QLMarkdown ("The precompiled app is notarized and signed") and MDViewer ("Signed & notarized").

Each blocked app has its own page with the fix that fits it:

• MarkText won't open on Mac: maintained, unsigned by choice, with a checksum file to verify.
• MacDown won't open on macOS: abandoned since 2020; the better fix is MacDown 3000.

Open it anyway: macOS 15 Sequoia, 26 Tahoe and 27#

Apple's Mac User Guide gives the same steps for macOS 15, 26 and 27:

1. Move the app to Applications and double-click it. macOS blocks it; close the alert.
2. Choose Apple menu ▸ System Settings, then click Privacy & Security in the sidebar.
3. Scroll to Security and click Open Anyway. Apple notes the button "is available for about an hour after you try to open the app."
4. Enter your login password and click OK.

The app is now an exception and opens normally from then on.

What changed in Sequoia. On macOS 14 and earlier, Control-click ▸ Open on the app gave you an Open button in the alert. Apple announced in August 2024 that "in macOS Sequoia, users will no longer be able to Control-click to override Gatekeeper". Most of the answers you'll find on forums predate that, which is why the shortcut seems not to work.

When the alert says "damaged": the xattr command#

macOS marks every file a browser or Homebrew downloads with an extended attribute, com.apple.quarantine. Gatekeeper checks apps that carry it when you first open them, so once it's removed, macOS no longer shows the alert for that copy:

/usr/bin/xattr -dr com.apple.quarantine /Applications/AppName.app

• -d deletes the named attribute, and -r repeats it on every file inside the app bundle.
• Replace AppName.app with the real name. Drag the app from Finder into the Terminal window to paste its exact path.
• I wrote /usr/bin/xattr in full on purpose. Some Macs have a second xattr, installed with Python, earlier in the PATH. It answers "option -r not recognized". Mine does.
• "Permission denied" means the app isn't owned by your account: run the same line with sudo in front.

To see whether an app still carries the flag, run /usr/bin/xattr -p com.apple.quarantine /Applications/AppName.app. "No such xattr" means it's gone. To run Gatekeeper's check yourself before deciding, run spctl -a -vvv -t exec /Applications/AppName.app: "accepted" with "Notarized Developer ID" means the app passes.

How risky is Open Anyway?#

Apple's guide is direct: overriding these settings "is the most common way that a Mac gets infected with malware", and you shouldn't do it "even if the app looks like it comes from a major developer". The warning is general, and an unsigned open-source editor isn't automatically dangerous. For a Markdown app, three things lower the risk:

• The source. Take the app from the project's own site or its GitHub releases, never from a "download for Mac" mirror.
• A checksum, when the project publishes one. MarkText ships SHA256SUMS.txt with each release; shasum -a 256 -c SHA256SUMS.txt --ignore-missing in the download folder prints OK for a matching file.
• Maintenance. An unsigned app that still gets releases, like MarkText, is a different case from one untouched since 2020, like the original MacDown.

What none of these can do is replace notarization: once the flag is cleared, macOS stops checking that app.

If you'd rather not override anything#

Pick a notarized app for the job. For writing, MacDown 3000 is free and passed Gatekeeper above; the Markdown editor comparison covers eight editors with prices and macOS requirements. For reading, the Markdown viewers for Mac guide compares free and paid viewers. MacMD Viewer, the one I make (so count me as biased), is notarized: Gatekeeper accepted the 1.8.3 DMG as "Notarized Developer ID" in the same test. It previews .md files in Finder with Quick Look and renders Mermaid diagrams; it costs $19.99 once, before tax. If you're weighing free against paid, free vs paid Markdown viewers on Mac goes through it.

Frequently Asked Questions#

What does "Apple could not verify is free of malware" mean?#

The app is not signed with an Apple Developer ID or not notarized by Apple, so macOS has no way to check that it is free of known malware or unaltered. It does not mean Apple found malware.

How do I open an app when Apple could not verify it?#

Try to open it once, then go to System Settings, Privacy & Security, and click Open Anyway within about an hour. Enter your password. On macOS 15 and later, Control-click and Open no longer bypasses the warning.

Which Markdown apps show this warning?#

As of November 5, 2026, MarkText and the original MacDown 0.7.3: neither is notarized, and Homebrew disabled both casks on September 1, 2026 for failing the Gatekeeper check. MacDown 3000 passed Gatekeeper when I checked it.

Is it safe to click Open Anyway?#

Only if you trust the source. Apple says overriding security settings is the most common way a Mac gets infected with malware. Download from the developer's own site or GitHub releases, check the published checksum if there is one, and never override for a copy from a mirror site.

Why does my Mac say the app is damaged instead?#

macOS reports an app as damaged when it detects that the software has been "modified or damaged". For an unsigned download from a trusted source, clearing the quarantine flag with xattr lets it open.

Sources#

All read or run on November 5, 2026. Apple: Safely open apps on your Mac · Open a Mac app from an unknown developer · Updates to runtime protection in macOS Sequoia. Apps: MarkText releases · MacDown releases · MacDown 3000 · QLMarkdown · MDViewer · Homebrew API for the mark-text and macdown casks. Gatekeeper checks: spctl -a -vvv -t exec and codesign -dv on macOS 26.3.