Protection · Threat feed
Daily threat feed: up-to-date signatures, a scan that stays on your Mac
A security check is only as good as how current its knowledge is. That is the job of MacNeat's threat feed: every day, the app fetches an up-to-date database that combines ClamAV signatures with an in-house list of Mac-specific threats, built from public sources. This feed powers the check in Rempart and the security check in Éclair.
Scanning happens entirely on your Mac: your files are never sent elsewhere to be examined. And because no tool catches everything, MacNeat does not replace the protections built into macOS, it complements them.
Two complementary sources
ClamAV signatures
ClamAV is an open-source antivirus engine, maintained for many years and widely used, notably on mail servers. Its signature database covers a broad range of malicious files, including booby-trapped documents and archives that travel across platforms.
The in-house Mac threat list
Threats aimed specifically at macOS have their own habits: fake installers, adware that sets itself up as a launch agent, credential stealers disguised as utilities. Novadesko compiles a dedicated list from public reports by security researchers and vendors: file hashes, agent names and telltale locations. This list targets what a general-purpose database can miss on a Mac.
Automatic, signed updates
- Every day: MacNeat checks for a new feed and downloads it in the background, with nothing for you to do.
- Ed25519 signature: every feed is signed by Novadesko. Before using it, the app verifies the signature with the built-in public key. A tampered or incomplete file is rejected, and the app keeps using the last valid feed.
- Offline: without a connection, scanning works with the last database received. You only lose signature freshness, not the feature.
Downloading the feed is the only exchange required: it goes from the server to your Mac, never the other way round for your files.
What gets scanned, and how
During a check, MacNeat compares files in sensitive locations against the feed: download folders, applications, launch agents and daemons, extensions and items that start with your session. Results come in two groups:
- Known threats: a file matches a signature. MacNeat flags it clearly and offers to remove it.
- Items to review: an agent or file shows suspicious traits without matching a listed threat. You decide, with the relevant details (location, developer, date).
To remove an active agent, MacNeat first unloads it, then moves it to the Trash. Nothing is erased outright, and the operation is logged so it can be undone. When something is detected, a "Suspicious item detected" notification lets you know.
Alongside XProtect and Gatekeeper, not instead of them
macOS already includes several defences: Gatekeeper checks app signatures and notarisation at launch, XProtect blocks known malware and Apple updates its definitions in the background. MacNeat neither disables nor bypasses any of these protections.
The threat feed adds a second pair of eyes: a different database, an on-demand or scheduled check, and above all a readable view of what runs in the background on your Mac. No solution, this one included, guarantees it will catch everything: a very recent threat can slip past signatures for a few days. Good habits remain essential, starting with installing apps only from the App Store or their developer's website.
History, reminders and principles
- History: every security scan is recorded in Bilan, with the number of threats found.
- Reminder: if your last check was more than two weeks ago, a recommendation lets you know.
- Free to scan: the check and the feed are available without a license. Removing detected items requires a license (7-day trial).
- Apple silicon and Intel, with the same feed on both architectures.