BlockBlock
Receive alerts when software attempts to establish persistence.GetGPL-3.0
Santa
A binary and file access authorization system for macOS that can monitor or block executables by signature or path.
Apache-2.0 · Downloads from github.com
- License
- Apache-2.0
- Open source
- Source
- GitHub
- northpolesec
- Verified
- 2026
About Santa
Santa uses a system extension to log program launches and decide whether they may run. In monitor mode everything not explicitly blocked runs and is recorded; in lockdown mode only allowed binaries run. Rules can target code signatures (team, signing ID, certificate or CDHash) or paths, and a GUI agent tells users when something is blocked.
It is aimed mainly at managed fleets, with configuration that can sync from a server. Google archived its original repository in 2025 and pointed users to this actively maintained North Pole Security fork.
Information
- Source code
- northpolesec/santa
- License
- Apache-2.0
- Website
- northpole.dev
- Download
- github.com
- Category
- Privacy & security
- Evidence checked
- Tags
Maco links to each project’s official download. Check its release notes for macOS version and Apple silicon support. The verification date records our license and source review, not a security audit.
Sources and image credits
- github.com/northpolesec/santa
- github.com/northpolesec/santa/blob/main/LICENSE
- github.com/northpolesec/santa/releases
- github.com/google/santa
- northpole.dev
- icon.png: North Pole Security and Santa contributors. Apache-2.0; upstream app icon, trademarks retained.
License and artwork notices
You Might Also Like
RansomWhere?
Watch for suspicious file encryption activity on your Mac.GetGPL-3.0
WhatsYourSign
Inspect a file's code-signing information from Finder.GetGPL-3.0
Sentinel
A small app for Gatekeeper chores: toggle it, clear the quarantine flag from apps, or re-sign them ad hoc.GetSource available
ClearanceKit
Block processes from protected files unless a rule tied to their code-signing identity allows it.GetMIT
Dylib Hijack Scanner
Scan for applications susceptible to dynamic-library hijacking.GetGPL-3.0
fob
Keeps SSH and Git signing keys in the Secure Enclave and asks for Touch ID, naming the destination, before each use.GetAGPL-3.0
KnockKnock
Inspect software configured to persist on your Mac.GetGPL-3.0
MakLock
Lock chosen apps behind Touch ID, Apple Watch or a password, with auto-lock on idle or sleep.GetMIT
OverSight
See alerts when processes use your Mac's microphone or camera.GetGPL-3.0
Pareto Security
Check your Mac for common security misconfigurations such as disabled FileVault, firewall or automatic updates.GetGPL-3.0
PureSnitch
Watch which hosts your Mac connects to and block untrusted ones with rules enforced by the packet filter.GetMIT