How Rio keeps your Mac safe

Rio is signed with a Developer ID and notarized by Apple since build 1446. Every web page runs in Chromium's sandbox, Google Safe Browsing warns you before phishing and malware sites, and every update is signed and checked before it installs. Rio ships Chrome's security fixes within a day of Google releasing them and sends no analytics.

Published November 12, 2026.

Signed and notarized by Apple

Since build 1446, released on November 12, 2026, Rio is signed with a Developer ID and notarized by Apple. Apple's own explanation of notarization is that Apple checked the app for malicious software and found none. When you open Rio for the first time, macOS asks once whether you want to open an app downloaded from the internet. Click Open.

You can check it yourself in Terminal:

spctl -a -vv /Applications/Rio.app

macOS answers accepted and source=Notarized Developer ID.

Every page runs in Chromium's sandbox

Rio is built on Chromium 158, the open-source project Chrome is built from, and it keeps Chromium's sandbox. On the Mac, Chromium's sandbox starts each web page's process from no access and allows only what that process needs, which keeps a page away from your files and the rest of your Mac.

Google Safe Browsing is on

Rio checks the pages you open against Google Safe Browsing's lists of phishing sites, malware sites and unwanted software. When a page matches, Rio shows a warning before it loads. The check sends Google only a short hash prefix, and only when a page matches the list on your Mac.

Signed updates, checked before they install

Rio updates itself with Sparkle. Every update is signed, and Sparkle checks the signature before it installs anything, which confirms the update is intact and came from Rio. Rio checks for updates every hour, and a card in the sidebar offers each new version: restart to install it, or it installs when you quit. The check sends no system profile.

Chrome's security fixes within a day

Rio ships Chrome's security fixes within a day of Google releasing them. When Google puts out a Chrome release with security fixes, Rio's next build carries the same Chromium fixes, and it reaches you through the updater above, with nothing for you to download.

Sites and apps ask first

A site that wants your camera, microphone or location has to ask, and you choose: allow this time, allow on every visit, or never. View, Site Permissions shows what a site can use, and you can change it there or from the command bar.

macOS adds its own layer. Before Rio itself can use your camera, microphone or location, macOS asks you, and you can turn that access off for any app in System Settings, Privacy & Security.

No analytics, no account

Rio sends no analytics and no crash reports, and it has no account. On its own, Rio only contacts:

GitHub, for the update check
Google Safe Browsing, with a short hash prefix when a page matches
Your search engine, with what you type in the command bar, for suggestions
Google's component updater, for Chromium parts such as the Widevine plugin
Sites in your sidebar, for icons of imported tabs and live folder feeds every 30 minutes, with no cookies

Your tabs, history and passwords stay on your Mac.

Code anyone can read

Rio is open source under GPL-3.0, so anyone can check what it does against the code on GitHub. If you find a security problem, report it privately: open the Security tab of the repository and choose Report a vulnerability. Please don't open a public issue for it.

Download Rio for Mac

Questions

Is Rio notarized by Apple?

Yes. Since build 1446, Rio is signed with a Developer ID and notarized by Apple, so it opens like any app you download: macOS asks once if you want to open it, and you click Open.

Does Rio collect my data?

No. Rio has no analytics, no crash reports and no account. Your tabs, history and passwords stay on your Mac.

Does Rio have Google Safe Browsing?

Yes, on by default. When a page matches Google's lists of phishing, malware or unwanted software sites, Rio shows a warning before the page loads.

How do I report a security problem?

Privately, through GitHub. Open the Security tab of github.com/Levivajan/rio and choose Report a vulnerability. Please don't open a public issue for it.