Guide · macOS
“Apple cannot check it for malicious software”: how to open it
This warning appears on apps and plug-ins that aren't notarized by Apple. It doesn't mean the file is unsafe, just that Apple hasn't scanned it. Here's how to open something you trust.
What it means
Apple runs a service called notarization: developers upload their app, Apple scans it for malware and stamps it as checked. When you open something that hasn't been through that process, Gatekeeper shows “cannot be opened because Apple cannot check it for malicious software.”
Plenty of legitimate, safe software is simply not notarized: small utilities, open-source tools, and audio plug-ins from smaller developers. The warning is about process, not proof of malware.
Three ways to open it
1. Right-click → Open
Instead of double-clicking, right-click (or Control-click) the app icon → Open, then confirm Open in the dialog. This tells macOS you intend to run it. (On the newest macOS versions this option can be removed for apps that fail notarization, so use method 2.)
2. System Settings → Privacy & Security → Open Anyway
The most reliable method on recent macOS:
- Try to open the app once and dismiss the warning (click Done, not Move to Trash).
- Open System Settings → Privacy & Security.
- Scroll to the Security section, where you'll see “[App] was blocked…” with an Open Anyway button.
- Click it, authenticate, then Open. You only do this once per app.
3. Remove the quarantine flag (Terminal)
If it's a plug-in or you'd rather use the command line, strip the quarantine attribute that triggers the block:
xattr -dr com.apple.quarantine "/path/to/YourApp.app"For an audio plug-in that also has a broken signature, clear everything and re-sign it:
sudo xattr -cr "/Library/Audio/Plug-Ins/VST3/YourPlugin.vst3"
sudo codesign --force --deep --sign - "/Library/Audio/Plug-Ins/VST3/YourPlugin.vst3"Fixing audio plug-ins? Skip the Terminal.
Plugin Medic clears quarantine and re-signs plug-ins for you: drop it on the window and click Fix & Sign. Free for one at a time.
Download Plugin Medic (Free) Universal · Apple Silicon & Intel · macOS 11+Difference between this and “damaged”
“Apple cannot check it” means not notarized. “…is damaged and can't be opened” usually means the signature itself is broken (often from the quarantine flag on an ad-hoc-signed plug-in). The fixes overlap: clearing quarantine and re-signing resolves both in the plug-in case.