There&#x27;s some additional irony in that apps can be sandboxed even when distributed outside the App Store, and many of these apps could function fine within the sandbox... except for Sparkle, which needs more access!<p>And there&#x27;s no particular reason everything in the App Store must be sandboxed. It used to not be required, then Apple changed the rules. Sandboxing helps with security, but for this particular question of a vulnerable app updater, simply using the App Store&#x27;s update mechanism would suffice to make it safe, even for non-sandboxed apps.