Marked seems to quarantine files automatically on my system

Question

Dear Brett,

Find below a clanker generated report of an issue I identified. Installed Marked 3 via App Store on my Macbook, right clicked a markdown file I had just generated minutes before and "Open With: Marked 3"'d it which resulted in a quarantine flag being added to it.

I know very little about Mac apps but trust/hope the clanker added sufficient identifying info for you, but let me know if I can add any more details please, I kept Marked installed and if this gets fixed(or sorted out on my end, if the problem is only there) I'll be extremely happy to buy it.

Thanks!

Marked 3 Adds Quarantine Metadata to Local Markdown Files

Date observed: 2026-07-03

Summary

Opening a local Markdown file with Marked 3 adds the macOS extended attribute
com.apple.quarantine to that file. The quarantine agent recorded in the
attribute is Marked.

After this happens, Finder/LaunchServices/Gatekeeper may show warnings when
opening the file, even though the file is plain local Markdown.

Marked Version

Application path: /Applications/Marked.app
Bundle identifier: com.brettterpstra.marked
Version: 3.1.7
Build: 1184
Mac App Store itemId: 6747497179
Mac App Store softwareVersionExternalIdentifier: 887747611
TeamIdentifier: 47TRS7H4BH

Reproduction Steps

Create a plain local Markdown file:

printf '# Test

Plain local Markdown file.
' > repro.md

Check its extended attributes before opening it:

xattr -l repro.md

Expected at this point: no com.apple.quarantine attribute.

Open the file with Marked.
Check the file's extended attributes again:

xattr -l repro.md

Observed Result

After opening the file with Marked, the file has quarantine metadata:

com.apple.lastuseddate#PS: ...
com.apple.provenance:
com.apple.quarantine: 0082;6a47cc18;Marked;

The timestamp component decodes to:

0x6a47cc18 -> Fri Jul  3 17:50:00 EEST 2026

The important part is that Marked is recorded as the quarantine agent:

com.apple.quarantine: ...;Marked;

Expected Result

Opening a local Markdown file in a Markdown viewer should not add
com.apple.quarantine to that file.

Notes

The tested file was plain local Markdown. It did not contain active HTML,
scripts, images, remote links, javascript: URLs, data: URLs, hidden control
characters, embedded payloads, or secrets.

The warning appears to follow the file metadata, not the Markdown content.

Brett Terpstra · Answer

Hi Anton,

Thanks for the detailed report — the repro steps and xattr output were exactly what I needed.

Short answer: Marked is not deliberately quarantining your files, and it is not changing the Markdown content. This is macOS attaching metadata when a sandboxed App Store app opens a document.

The MAS build runs in Apple’s app sandbox. When it opens a file, macOS often adds com.apple.quarantine (with Marked as the agent), plus things like com.apple.provenance and com.apple.lastuseddate#PS. That matches your output. The 0082-style flag is typical sandbox document tracking, not a sign the file came from the internet or is unsafe.

I checked the codebase and confirmed Marked does not set com.apple.quarantine. It reads your file to render the preview; the system adds the attribute when the sandboxed app accesses the file — including via File → Open inside Marked, which I verified has the same effect as Open With in Finder.

What usually helps:

Clear it if needed: xattr -d com.apple.quarantine /path/to/file.md — though opening the file again in the MAS build may re-add it.
The direct build is not sandboxed and does not do this; see Sandbox Restrictions for MAS limitations, if you haven't purchased yet, I would highly recommend getting the Paddle version instead of MAS, it solves all sandboxing issues and also gets much faster updates and fixes.

There’s no API to opt out — it’s platform behavior. I’m planning a short troubleshooting note so others aren’t surprised.

Your file is fine; this is metadata macOS uses for sandbox tracking, not Marked treating local Markdown as untrusted.

Anton Waniek · Answer

Hey Brett,

Thanks a lot for the prompt reaction. I did as you recommended and I'm using the app without issue since.

It seems the "Accept" (answer) button on this ticket form isn't working though, so I'm accepting your answer with this reply.

Thanks again and keep up the good work🙏!