Notarization & security
Boswell is a native macOS app signed with a Developer ID certificate and notarized by Apple’s notary service, with the hardened runtime enabled. This is the same chain of trust that macOS Gatekeeper checks before allowing any app to run.
What notarization means
Section titled “What notarization means”When Apple notarizes an app, its automated system scans the binary for known malware and confirms the developer’s identity. The hardened runtime adds a second layer: it restricts the processes Boswell can launch, the entitlements it can use, and the libraries it can load — even if malicious code somehow ended up in the package.
In practice: macOS verifies the signature on every launch. If the binary has been tampered with since notarization, Gatekeeper blocks it.
How to verify it yourself
Section titled “How to verify it yourself”You can check the signature on the app from Terminal at any time:
spctl --assess --type exec --verbose /Applications/Boswell.appA notarized, unmodified app returns:
/Applications/Boswell.app: acceptedsource=Notarized Developer IDTo inspect the certificate chain:
codesign -dv --verbose=4 /Applications/Boswell.appLook for Authority=Developer ID Application: ... and Authority=Apple Root CA in the output.
On-disk file ownership
Section titled “On-disk file ownership”Boswell writes to ~/Library/Application Support/Boswell/ for its data — recordings, transcripts, and notes — and, when you export a note as Markdown, to the location you choose for that file. It does not write to system directories or other users’ home folders. Everything Boswell writes is owned by your macOS user account — no elevated privileges required.
Vulnerability disclosure
Section titled “Vulnerability disclosure”If you find a security issue in Boswell, email security@meetboswell.com. The full disclosure policy — scope, safe harbor, and what to expect — is at meetboswell.com/security.html.