LocalInbox checks every attachment before it downloads or opens. Programs, installers and scripts are blocked, even when they're named like a document or hidden inside a ZIP, and LocalInbox says why. Web pages, Office documents with macros, disk images and archives it can't look inside show a warning, and opening one in another app asks first.
Blocked: anything that runs
- Mac apps, installers, scripts and plug-ins, such as .app, .pkg, .command and .scpt.
- Windows programs and scripts, such as .exe, .msi, .bat and .ps1.
- A program named to look like a document, such as invoice.pdf.app or a photo that's really an executable. LocalInbox checks what the file is, not just its name.
- A ZIP with a program inside.
- Blocked attachments can't be downloaded, saved, dragged out or opened, and Why Is This Blocked? explains in plain words.
A warning first: files that can be risky
- Web pages (.html, .svg), which can ask for passwords as if they were a real site.
- Office documents with macros, such as .docm and .xlsm.
- Disk images, such as .dmg and .iso, which can hold apps.
- Password-protected archives, and archives LocalInbox can't look inside.
- Names that use hidden characters to look like something else.
macOS checks too
Every attachment LocalInbox downloads is marked as downloaded from the internet, so Gatekeeper checks it when it's opened, as it does for files from a browser.
Questions
Does LocalInbox scan attachments with an online service?
No. The checks run on your Mac, from the file's name, type and contents. Nothing is uploaded.
Someone really needs to send me an app. What now?
Ask them for a download link from the developer's website, or open the message in your provider's webmail. LocalInbox doesn't open programs sent by email.