Sandboxed

The macOS App Sandbox is mandatory for every Mac App Store app, but explanations of what it permits are often incomplete or flatly contradictory. Sandboxed replaces folklore with a small, repeatable experiment.

Run the included command before granting access to its directory and it fails. Bookmark that location through the standard system picker, run the exact same command again, and it succeeds. The command did not change; the sandbox's user-approved access did.

That distinction clears up a common misconception: a sandboxed app may execute certain Apple-signed system binaries inside a directory the user has explicitly authorized. It does not gain blanket access to every system binary, and package-manager or privately installed binaries still cannot be executed through the app as a middleman.

Sandboxed also identifies which apps on your Mac use the App Sandbox and which do not. It is useful for developers validating their mental model, and for anyone curious about what the security boundary actually feels like instead of merely reading another oversimplified description.