macapps Subreddit Mac Apps Reddit r/macapps Backup by AppleStyle on Telegram
88 subscribers
2.48K photos
574 videos
16.4K links
r/macapps subreddit backup on Telegram. A backup Project by @RoadToPetabyte and @AppleStyleOfficial https://pixly.me/rtp Join our subreddit backup on Discord, Telegram and Pinterest: https://discord.gg/abCudZwgBr or @redditbackup
Download Telegram
I tested every “lifetime” Mac app posted on r/macapps for 7 weeks – 32 apps, 32 bypasses

**TL;DR:** Over 7 weeks I tested 32 “lifetime” Mac apps posted on r/macapps (non–App Store, direct downloads). Every single one had at least one real way to bypass its licensing or Pro checks using only local tools, no binary patching. For most users that just means “someone can get free Pro”, but a few apps had issues serious enough that, in the wrong hands, they could be abused for malicious updates or other supply‑chain style attacks. I named every app and privately reported all issues to the developers. The top two devs (Resurf and How To Convert) handled things almost perfectly. The bottom two (Glyph and Droppy) either blocked me or turned hostile after initially asking how to donate.

I recommend reading this full post or reading the write-up I did of all 32 apps, methodology, and responses.: [https://kamidevs.com/blog/macapps-audit](https://kamidevs.com/blog/macapps-audit)

\---

# Well, before we start, I think it's fair to say, who am I?

Well, kind user, thank you for asking! I'm Kami, also known as SenpaiHunters. I am a developer and a security research engineer. I've been cracking apps for over 7 years, so I've gained enough skills during this time to figure out how a Mac app will always run, whether it is native code like Swift or cross-platform like Electron.

You may also know me as a core developer of Loop, a FOSS window manager.

It's important to tell you that throughout this review, I am not affiliated with, paid for an increased rating, personally know, or otherwise act in disingenuous behavior to benefit a singular or multiple developers to gain a paid or better audience. All of the messages I sent were the first time doing so, and if you'd like more knowledge on an app I've reviewed, you're free to ask!

# What did I do?

From 20 January to 10 March 2026, I opened every post on r/macapps that used the “Lifetime” flair. I skipped Mac App Store–only apps and downloaded every other app that offered a paid lifetime license via direct download.

Every app I looked at was:

* distributed outside the Mac App Store
* signed with a valid Developer ID and passed Gatekeeper / notarization when installed

For each one, I asked a single question:

*"Can I bypass this app’s licensing as a normal user without patching the binary?"*

I limited myself to what a determined but “normal” user could do on their own Mac. I did use a local HTTPS proxy, `defaults`, `plutil`, `security`, Keychain Access, and edits to files under `~/Library` and other common directories. I did not use a disassembler, patch or re‑sign binaries, or attach a debugger to change code in memory. The idea was to see what someone can do with off‑the‑shelf tools, while still running the official build.

In that seven‑week window, I ended up with 32 lifetime‑license Mac apps. All of them passed Gatekeeper and notarization. All of them were bypassable at the licensing level using only local tools.

# Why this matters for normal r/macapps users

You might be asking me, “So if I install a vibe-coded app, am I at greater risk of having my email, passwords, or data exposed?”

Most of the issues I found are license and trial bypasses. For the typical user, that’s not immediately catastrophic, it mostly means:

* some people can get Pro without paying
* trials can be reset indefinitely
* the developer is losing revenue and doesn’t realise how flimsy their checks are

Where it becomes a real user‑safety problem is when the same “vibe‑coded” mindset hits the backend or update logic. In a few apps I saw problems like:

* Supabase row‑level security that allowed authenticated users to edit license or release tables (including update URLs)
* Credentials or tokens that could, if abused, be used to push malicious updates as if they were official

Those are the cases where, yes, installing the app could put you at greater risk. Not because the developer is necessarily malicious, but because they shipped something where an attacker could hijack the update channel or tamper with
data.

Because at the end of the day, you're deciding if this product is for you and if this money to spend is worth it. Also, consider who the developer is, whether you are willing to give it a shot, and if you believe you should do a quick review yourself.

If you need to think about it, here's what I suggest.

* Gatekeeper and notarization say “this probably isn’t obvious malware right now”, they do not say “this licensing, backend, and updater are robust”. Every app in this audit passed Apple’s checks, and every one was bypassable on the licensing side.
* Vibe‑coded apps (stitched together from docs/AI/snippets) tend to have the same security mistakes: trusting any JSON with `success: true`, keeping license state in UserDefaults or flat files, or misconfigured Supabase where users can edit their own license rows.
* A developer’s reaction to private reports is a strong signal. Some devs treated this as free security work, fixed things, and stayed professional. Others read the report, then ghosted or blocked me. If someone blocks you for reporting a bug, that is not the kind of person you want in charge of your update pipeline.

So if you’re about to buy a “lifetime” app from here and store anything sensitive in it (notes, API tokens, documents, whatever), it is worth taking a couple of minutes to see who built it, whether they have a real contact/security channel, and how they respond to issues.

# The app reviews?

Now, let's get to the fun and reviews. This is only a small snippet, and it will include the top two apps, scoring 10/10, and the bottom two apps, scoring 0/10. The entire write-up of all 32 apps is posted on my blog for you to read. You can quickly use cmd+f to search to see if your installed or favorite app was tested, how they responded, if it is fixed, and what the issue is or was.



**Top 2: best developer responses**

*Resurf* – rating 10/10

This is an Electron app. I found ways to bump it to Pro using both network‑level tricks and local state manipulation. The developer ( u/Hungry_Spite3574 ) responded in roughly 6 hours, asked good questions, and shipped a fix within a day. Communication was respectful and focused on understanding and resolving the problem, not arguing about it.

Email: [[email protected]](mailto:[email protected])

Response time: about 6 hours

Fix: about 1 day

Code quality: some AI usage, but the dev clearly understands their own app and trade‑offs



*How To Convert* – rating 10/10

Here the core issue was a Supabase auth bug that allowed a licensing bypass. I reported it through GitHub’s security process. The developer ( u/jakecoolguy ) fixed it within roughly the same window and there was no drama: no defensiveness, no arguing, just “here’s the issue, here’s the fix”.

Response time: about 10 hours

Fix: about 10 hours

Code quality: clean and understandable



**Bottom 2: worst developer responses**

*Glyph* \- rating 0/10

Glyph uses Gumroad for licensing. The app trusts the JSON response from the Gumroad API directly. With a local HTTPS proxy you can change the response so it looks like a successful activation, and the app unlocks Pro.

I reported this by DM. The DM was ignored and I was then blocked. There was no attempt to engage with the report, no follow‑up questions, and no visible fix.

Response: blocked after report

Fix: none implemented or communicated



*Droppy* \- rating 0/10

Droppy’s backend itself is not the worst in the list, but the client still trusts JSON from the backend too much. A local proxy can flip `valid: false` to `true` and the app accepts it. That’s the technical part.

The interaction was the real problem. The developer was very positive at first, calling the report “awesome” and asking for a way to donate. I sent a Polar link. After that there were more than 9 days of silence despite clear activity elsewhere. When I followed up via email ([[email protected]](mailto:[email protected])), the reply was defensive and described me as “demanding”.

From both a security‑process and user‑support perspective, this was the worst
interaction in the entire run. If that is how security reports are handled, I would not recommend an app developed by this person.

Response: initially positive, then ghosted, then defensive

Fix: none

Code quality: entirely vibe coded



# What next?

Now that we see these apps, we're at a crossroads. What next? Well, I'll first give some recommendations to you, the user, and then to a developer who may have these issues or wish to look further at their app.

I always recommend that, no matter how much money or how little data it is, you first believe that the developer is telling the truth, is able to actually code (although this is a lot harder; check for common "vibe coding," i.e., emojis, bolded text, gradients, and other junk), how they respond, and whether it is honestly worth it. At the end of the day, I'm not here to tell you how you should spend your time or money; I can only give you tips and help you make an informed decision.

So, let's move on, shall we?

# Common failure patterns I kept seeing?

This is a TL:DR of what's posted in my blog, but,

* Trusting plain JSON from Gumroad / Lemon Squeezy / Polar or custom APIs and only checking simple flags like `success: true` or `activated: true`
* Storing critical license or trial data in UserDefaults or unprotected JSON/MessagePack files in Application Support
* Misconfigured Supabase row‑level security, allowing users to modify their own license rows or even release/update tables
* Treating a specific Keychain item’s existence as “Pro is on”, which can be faked with normal macOS tooling

Now, for those who are looking to develop or have an app that may have a flaw listed here, how can we fix it?

* Validate more than one “success” flag in JSON. Check product IDs, users, expiry, and signatures.
* Keep real license decisions on the server where possible; treat local data as a cache.
* Lock down Supabase RLS so users cannot modify license or release rows they shouldn’t touch.
* Sign or MAC cached license state on disk.
* Publish a clear way to report security issues, and respond like you actually want your app to survive.

Good examples of how to react include Resurf, How To Convert, LowTechGuys (Pipiri), InfiniDesk, Taphouse, Seam, and OS‑Engine. None of them were perfect; they just treated reports as a chance to improve, not as a personal attack.

# The end

If you wish to have your own app reviewed, you can see https://kamidevs.com/application-security. I aim to do free reviews for a developer's first app if they're a student or cannot afford one (see the 32 I just reviewed). For those who wish for a review but are unsure of pricing, discounts may apply.

I am free and open to any and all questions you might have, such as, can you give me tips on managing an app's security in Swift, or other questions, or what an app was like, expanded, i.e., you wish to know my thoughts on the app's UI/UX and security for any of the posted ones, or in general, how was your night? This post is, however, made at the time of posting, 23:50, so I will be going to bed, but you can expect a reply in 12 hours if this post wasn't mass reported or removed!

Now, this, is the end of the post, it's just a small post, on what is fully written in my blog, see that for,

* all 32 apps, names and links
* per‑app notes, ratings, and interaction summaries
* more detailed explanation of “vibe‑coded” apps
* concrete advice for better licensing and update security

Full writeup: [https://kamidevs.com/blog/macapps-audit](https://kamidevs.com/blog/macapps-audit)

# NOTICE

If you’re a developer whose app is on the list and you think I’ve been unfair, or you want a follow-up review, contact me privately; my details are at the end of the blog or in the messages/emails I've previously sent. If you wish for a proper conversation, please send me a message on Discord. I do not like Reddit chats as it lacks functions I normally use.

https://redd.it/1ryvdei
@macappsbackup
Any app for click and scroll?

Hi there, when I want to select text, I usually click and then scroll. However, for some reason, this doesn’t work on macOS. Is there any app that could help me?

Thanks!

https://redd.it/1rz0ypc
@macappsbackup
TuringShot v1.4.4 (formerly ZoomShot) - Live screen zoom, focus highlight, magnifier lens, drawing & text memo for macOS

Hey r/macapps,

I've been recording coding tutorials on my Mac for about 10 years now. Over that time I tried pretty much everything to make screen recordings more engaging. DemoPro for drawing, ScreenStudio and FocuSee for auto-zoom. They all had tradeoffs. ScreenStudio zooms in on every single click, which sounds cool until you're trying to draw on screen and the whole view jumps around.

So I ended up building my own tool. It started as ZoomShot, recently rebranded to **TuringShot**.

https://i.redd.it/h4zkj2r858qg1.gif

**What it does:** Adds live visual effects to your screen that show up in any screen recording (OBS, Zoom, QuickTime, whatever) since it works at the OS level.

**Features:**

* **Screen Zoom** (free) - Ctrl+A + scroll to zoom when you want, not on every click
* **Focus Highlight** \- Spotlight effect around your cursor with impact animation
* **Magnifier Lens** (new in v1.4.4) - Magnifies just the area around your pointer like a loupe, without shaking the whole screen
* **Live Drawing** \- Ctrl+X + drag to draw lines, rectangles, circles directly on screen
* **Text Memo** \- Ctrl+Q to place text notes on screen, auto-resizing and fully stylable

You can customize all of shortcuts as well.

The v1.4.4 update adds the Magnifier Lens which I've wanted for a while. Sometimes you need to zoom into a small area without moving the entire view. The lens magnifies what's around your pointer with adjustable strength and a glass effect. Works alongside Focus Highlight or on its own.

Been pushing updates almost weekly since v1.3.6. Trying to get this right.

**Pricing:** Screen Zoom is free forever. Full features: $2.99/year or $9.99 lifetime.

**Promo code:** TURINGSHOT66 gets you the yearly plan for $0.99 (expires 3/31)

[App Store](https://apps.apple.com/app/id6758536367) | [Website](https://www.turingshot.site/)

[Feature overview](https://files.catbox.moe/2hql2x.png)

Happy to hear feedback or answer questions!

https://redd.it/1rz03j5
@macappsbackup
Do you have experience with the hazel app and terminal commands? i'm kind of swamped and could do with some help creating the rules if so (please)

I'm even willing to pay for your time to get it done, and you're quite welcome to save the rules and share them with others once they're completed. Basically I would like a set of rules that will achieve the following:

1.) Convert files from .cbr to .cbz (it's an OCD thing, just go with it - I like order) extract the scan group image from the back of "acquired" digital comics that I can add and subtract to in some form of black list.

2.) Move said comics from one location, to automatically sort into different folders that correspond to the comic title. Again, it would be neat if I can add and subtract folders as and when I need them, so in both cases the rulesets would be appreciated if they ran applescript or shell commands.

That's it. That's the gig. If you require payment while i'm reticent to use paypal, I'm sure I can figure it out, but in the interests of sharing I would be happy for you to disseminate the rules on the noodlesoft forum or wherever you see fit as well.

Thank you if you've taken time to read this slightly odd and admittedly very lazy request.

https://redd.it/1rzhxxc
@macappsbackup
Managing lots of open windows on macOS – what’s your setup?

I’m trying to improve my multitasking setup on macOS and I’m looking for app recommendations from people who manage lots of open windows daily.

Typical workflow for me:

* multiple Safari windows (2 profiles, work and private)
* several work apps open at once
* switching between contexts frequently during the day

Main things I’m looking for:

1. A better Alt+Tab-style window switcher (something closer to Windows behavior, ideally with previews and switching between individual windows instead of just apps)
2. A solid window snapping/layout tool ( on Linux I used hyprland and i3)
3. Tools that help manage large numbers of open windows/apps more efficiently overall
4. A reliable app uninstaller that removes leftover files too

I tried Raycast and really liked how fast it is, but I’m still unsure about using it long-term because of privacy/security concerns around extensions and the AI features.

Curious what setups people here are using for this kind of workflow. Free or paid suggestions are both welcome.

https://redd.it/1rztv05
@macappsbackup
Feedback: the "lifetime license audit" thread

Lets talk about that "lifetime app security thread" that is now closed. I tried to go into it with the intention of learning But even After reading the full blog post, I mostly came away irritated.

The Reddit thread already had a loaded, prosecutorial vibe, and the blog made it plain. Everything got turned into a public scorecard. Apps ranked top to bottom, developers graded on how well they replied, ghosted counts, blocked counts, lower scores for ignoring it, pushing back, or getting annoyed. And the whole "vibe coded" thing just felt like OP was "branding" app developers with judgment. I felt (reading some of the replies) that some developers were hastily replying and capitulating because they were afraid that the crosshair would be on them next if they didn't. It honestly was starting to feel a bit like weaponized auditing.

I still don't buy the core premise...If a license check gets bypassed, that tells me the licensing is weak. That's all it tells me. It doesn't automatically mean the app is unsafe. Piracy resistance and user safety are separate questions, and this post kept rubbing them together until the distinction was gone. A flimsy paywall, a sloppy entitlement flow, and an actually dangerous update path are not the same problem. I still haven't seen the missing step that turns “someone can pirate this” into “ordinary users are at risk.” Why does the licensing security actually matter? Don't we all maintain the idea that piracy is a service issue and not a technical one? That if the product is excellent and easy to buy, people tend to actually buy it??

It also felt extremely self-promotional...The post starts out findings, then swings right into naming the "good" developers and the "bad" ones, assigning scores, calling some apps “purely vibe coded,” plugging paid reviews, free first reviews, donation links, sponsor links, a licensing package, etc. All while claiming the moral high ground for policing this corner of the Mac app world that no one asked for?

Some developers got defensive. Warlock did (sorry to call you out dude). But After reading the full post, I can see why. If somebody publicly grades your app, folds your inbox behavior into the grade, writes the whole thing with an editorial sneer from line one, and leaves readers thinking weak licensing might also mean their data is in danger, you're going to feel attacked. Some replies were heated, sure, but that frustration didn't randomly appear out of thin air. By then the thread had already drifted away from useful critique and into hit-piece territory.

And I'm sorry but The moderation was just bad. Plainly bad. The thread stayed up while the framing got harsher, then it got locked with a note that still leaned on the idea that people were just offended by scrutiny. That honestly feels really disingenuous. Developers can handle scrutiny. What they got here felt a lot more like being attacked. It felt like Mods had plenty of chances to step in, demand tighter evidence, strip out the scorekeeping garbage, or shut it down after several corrections that the OP had to make.

I just think we're better than this. Im not sure what the OP was trying to add but it left a really sour taste in my mouth that the post was left up and seemingly defendced by a moderator.

https://redd.it/1s021oe
@macappsbackup