Floodtide checks every app on your Mac for security problems, free
Updated
Since version 1.5, every scan ends with a security pass over every app it found. The pass looks for five kinds of evidence, and the app always says which kind it found and where it came from, so a weak signal never reads as a confirmed vulnerability. Seeing the results is free on every copy. This page says what each check looks at, what it shows, and what it never claims.
What “every app” means
Every app Floodtide finds is checked, covered or not, including the ones no update source can read. What differs from app to app is how much there is to go on. A published fix with a version number is strong evidence; an app nobody has updated in two years is a reason to look, not proof of a problem. So the findings come in five kinds, strongest first, and each one names its kind and its source.
The results sort into groups. Security updates are the two strongest signals: a fix someone has published for a version newer than yours, and an update the developer marks as critical. Worth a look holds the weaker ones. Trust is about the copy on your Mac and who signed it. The apps where nothing was found are listed too, folded away, with their number.
A finding is never a score. Floodtide shows no CVE scores and no severity ratings, and never adds findings up into a number of vulnerabilities. Where the evidence is weak it uses the weaker wording, or shows nothing, because a wrong security warning is worse than a missing one.
The five checks, strongest first
Each check below names the evidence it uses, the words it puts on screen, and what it never claims.
1. A published security fix
The installed version is older than a version that fixes a security problem, and a source that knows has said so with a version number.
- Evidence. One of three sources naming a fixed version above the one installed: a record in Floodtide’s signed catalogue, written by hand from the developer’s own advisory; the community-maintained SOFA feed of Apple’s security releases, for macOS and Safari; or a security advisory published on GitHub for the app’s own repository, for apps Floodtide updates from GitHub.
- On screen. “Security update”, the version the fix shipped in, and a link to the advisory. These rows open the Updates list, in a section of their own.
- Never claims. That an app is affected because of its name. Each source is tied to the app itself, through its own record, its GitHub repository or Apple’s own releases, and is never matched by name against a general list of vulnerabilities.
2. The developer says so
The developer marks the update on offer as critical, or its release notes mention a security fix.
- Evidence. For a critical update, the critical mark a Sparkle update feed carries for exactly this purpose. For release notes, the notes of the update on offer, searched for security phrases such as “security fix”, “vulnerability”, “CVE-” and “exploit”, in English and German, as whole words.
- On screen. “Critical update (marked by the developer)”, which counts as a security update. A phrase in the notes reads “Release notes mention a security fix”, with the line it found quoted, and sits under Worth a look rather than counting as a security update.
- Never claims. What an update fixes beyond the developer’s own words. A phrase in the notes is shown as a phrase, not as a confirmed vulnerability.
3. An outdated engine
The installed app is built on a framework that no longer gets security fixes, or on a version of one with known security flaws.
- Evidence. The version of Electron or Sparkle inside the app bundle itself. Electron supports its three newest major versions, so an older major line no longer receives fixes; Floodtide reads which lines are current from Electron’s own release list. For Sparkle, the built-in updater many Mac apps carry, the versions with published security flaws.
- On screen. For example “Built on Electron 28, which no longer gets security fixes”, or that the app’s built-in updater, an older Sparkle, has known security flaws. Worth a look; when an update is waiting, the row says the update may fix it.
- Never claims. That the app itself can be attacked. A developer can work around a flaw in an old engine, so this is a reason to look, never a security update on its own.
4. No longer updated
The app’s developer has stopped, or nobody has released a new version in a long time.
- Evidence. Floodtide’s catalogue marking the app as discontinued by its developer, or the newest release any of its sources knows being more than two years old.
- On screen. “Discontinued by its developer”, or “No update since” with the month and year of that release. Worth a look.
- Never claims. That an old app is unsafe. Plenty of small tools are finished rather than abandoned; the line is there so you can decide.
5. Trust in the copy you have
Whether macOS can vouch for who built the copy on your Mac, and whether the update on offer comes from the same developer.
- Evidence. macOS’s own code signature checks, run on the installed copy: not signed, signed ad hoc, or a signature that no longer matches the app. An unavailable offline notarisation result produces no finding. For the update on offer, the developer team in its signature, compared with the installed copy’s.
- On screen. “Not signed”, “Signature is broken”, or “New developer:” with the new team’s name and the old one. These sit under Trust. An update from a new developer never installs automatically, under any setting: Floodtide stops and asks you.
- Never claims. That an app is malware. Many honest open source apps are not notarised; it means Apple has not checked that build, not that anything is wrong with it.
Where the findings show
- Security, in the sidebar. A page of its own under Library, with a count of the apps that have a security update. It opens with one line saying how many apps Floodtide checked and what it found, then lists security updates, the apps worth a look, trust findings, and the apps where nothing was found.
- The Updates list. Rows with a security update come first, in a section of their own, each tagged Security update. The section’s tick box selects them all for Update Selected.
- Each app’s details. A Security group lists the app’s findings with their links, or says it was checked and nothing was found.
- The header and the menu bar. When any app has a security update, both say how many.
- A notification the same day. A setting, Tell me the same day about security updates, is on by default. It keeps to your quiet hours and announces each update once.
- Export App List. A Security column lists each app’s findings.
Worked out on your Mac
The matching happens on your Mac, and the security check sends no app list, findings or identifier. If you have enabled optional anonymous usage sharing, its existing daily report of app names and versions is unchanged. You can turn that off in Settings, Privacy.
To know what is current, Floodtide reads a few public lists: the SOFA feed of Apple’s security releases, Electron’s release list, Sparkle’s public security advisories, and, for apps it already updates from GitHub, the advisories on that repository. These are plain downloads, like an update check, kept on the Mac for a day and limited in size. If one cannot be read, the check it feeds shows nothing rather than guessing. The privacy policy lists every request the app makes.
Free to see, a licence to install
Seeing the findings is free on every copy: during the trial, after it, with a licence or without one. None of it is part of the Tide.
Installing an update stays what the licence buys, as it always has: £10.99€12.99$14.99 once for 3 Macs, after a 14-day trial that unlocks everything.
Security updates only
Automatic installing has a new choice, Security updates only. With it, a scheduled run installs just the updates that fix a published security problem or that the developer marks critical, and leaves everything else on the list for you. Like every automatic install it needs a licence, and it runs the same checks as an update you start yourself.
An update signed by a different developer team than the copy you have never installs automatically, under any setting; it waits for your answer. How Floodtide verifies an update.
What the check is not
- A virus scanner. Floodtide does not look inside apps for malicious code. It reads what developers and Apple have published, and what macOS says about the signature.
- A score. No CVE scores, no severity words, no count of vulnerabilities. A finding says what kind of evidence it is and links to its source where available.
- A guarantee. An app with nothing found is one where none of the five checks found evidence. That is not a promise the app has no flaws.
Common questions
Is the security check free?
Yes. Every copy sees every finding, during the trial and after it, with or without a licence. A licence is what installs updates, as before, and nothing about the check is part of the Tide.
Does Floodtide send my app list to check it?
No. The matching happens on your Mac and the check sends nothing new. It reads public lists: Apple’s security releases through the SOFA feed, Electron’s release list, Sparkle’s public security advisories, and the GitHub advisories of apps Floodtide already updates from GitHub.
Does Floodtide show CVE scores?
No. It shows what kind of evidence it found and where it came from, with a source link where available, and never a score, a severity word or a count of vulnerabilities.
What does Worth a look mean?
A weaker signal: release notes that mention a security fix, an engine that no longer gets security fixes, or an app with no update in more than two years. None of those counts as a security update on its own.
Can Floodtide install only security updates automatically?
Yes, with a licence. Choose Security updates only for automatic installs, and a scheduled run installs just the updates that fix a published security problem or that the developer marks critical. An update from a different developer never installs automatically.
See what it finds on your own Mac
The scan and the security check are free and need no account. 14 days of the full app, then both stay free; a licence is £10.99€12.99$14.99 once for 3 Macs.