Glossary/macOS Keychain & security
App Sandbox
The App Sandbox is a macOS security system that restricts what a running app can access by default, such as arbitrary files, other apps' processes, or network resources, unless the app explicitly declares and is granted specific entitlements for them.
Why it matters
Sandboxing is mandatory for apps distributed through the Mac App Store, which is one reason some categories of developer tool, ones that need to inspect other processes or run arbitrary subprocesses freely, are more often distributed directly.
Does an unsandboxed app mean less security?
Not inherently, it means the app relies on code signing, notarization, and its own design instead of the sandbox's automatic restrictions.
Can a sandboxed app still access the Keychain?
Yes, Keychain access is available to sandboxed apps through a specific, declared entitlement.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.