Is Boring Notch Safe? What the macOS Warning Means (2026)

You downloaded Boring Notch, double-clicked it, and macOS told you it couldn’t verify the app is free of malware. Fair question, then: is it safe?

Short answer: mostly yes, with one caveat. Boring Notch is open source under GPL-3.0, so anyone can read what it does, and the macOS warning appears because the developers don’t have an Apple Developer account, not because Apple found anything wrong. But “open source” and “unsigned” together mean nobody at Apple has checked a given download for you. You’re trusting the project, so only install it from the official source.

Seam in island mode on a Mac without a notch, showing the compact now playing pill

Why macOS Shows the Warning

Apple wants every app from outside the App Store to be signed with a developer certificate and notarized, which means Apple scanned it automatically. An app that passes opens without a fuss. An app that doesn’t gets the “Apple could not verify” dialog.

Boring Notch’s own README says why it hits that wall: the team doesn’t have an Apple Developer account. That costs money every year, and it’s a free project. So macOS treats the app as coming from an unidentified developer.

The dialog tells you Apple hasn’t vouched for the file. It does not tell you the file is bad.

What Boring Notch Has Going For It

The code is public. It’s on GitHub under GPL-3.0, with around 10,900 stars. Many people have looked at it, and anyone can check what a release contains.
It’s been around. A long public history of issues and releases is a better trust signal than a polished landing page.
It asks for what a notch app needs. Things like calendar access for events, or the camera for its mirror feature, are what a notch app would plausibly want. Read each permission prompt and say no to any feature you don’t use.

What It Doesn’t Give You

No Apple notarization. A notarized app has been scanned by Apple for known malware before you ever see it. This one hasn’t.
No guarantee about the file you downloaded. Open source means the code can be checked. It doesn’t mean the DMG on some random site matches that code. That’s the real risk, and it’s the one you control.
A habit you may not want. Each time you bypass Gatekeeper for one app, it gets easier to do it for the next one. Some people would rather not.

How to Install It Without Taking a Risk You Don’t Need To

Get it from the source. Use the releases page on GitHub, or Homebrew:
```
brew install --cask TheBoredTeam/boring-notch/boring-notch
```
Open it once. macOS will block it. Go to System Settings, then Privacy & Security, scroll down and click Open Anyway.
Or use Terminal. The README gives this command, which removes the quarantine flag from the app:
```
xattr -dr com.apple.quarantine "/Applications/Boring Notch.app"
```
Read the permission prompts. Allow what you’ll use. Deny the rest. You can change it later in Privacy & Security.

Run the Terminal command only on a copy you got from the official repository. Running it on an app from anywhere else switches off the one check macOS had.

If You’d Rather Not Bypass Anything

That’s a reasonable position. Seam is signed and notarized, so it opens like any other Mac app with no warning and no Terminal. It costs $29 once, and the 48-hour trial needs no credit card. It isn’t open source, so you can’t read the code the way you can with Boring Notch. You get Apple’s check instead.

Boring Notch is free and does music, a file shelf, battery and a few HUDs well. Seam adds offline voice typing, a focus timer and calendar in the notch. If those aren’t what you want, stay with Boring Notch and install it the careful way.

Frequently Asked Questions

Is Boring Notch malware?

No evidence says so. It’s open source, widely used and publicly maintained. The macOS warning comes from the missing Apple signature.

Why does macOS say Boring Notch is from an unidentified developer?

The project has no Apple Developer account, so the app isn’t signed or notarized. Gatekeeper warns about any unsigned app.

Is it safe to run the xattr command?

For the Boring Notch copy from its own GitHub or Homebrew tap, yes. It’s the command the README gives. Don’t use it on an app from a source you don’t trust.

Does Boring Notch need a lot of permissions?

It asks for access it needs for specific features, such as calendar or camera. Allow only the features you use.

What’s a safe alternative that doesn’t trigger the warning?

Any signed and notarized notch app. Seam is one, at $29 once with a 48-hour no-card trial.