How to Install macOS on an Intel Mac: Recovery, USB Installer, T2

To install macOS on an Intel Mac, start up from macOS Recovery by holding Command-R as the Mac turns on, then choose Reinstall macOS. For several Macs or a failed Recovery install, build a USB installer with Apple's createinstallmedia command. Apple's compatibility pages show macOS Tahoe 26 is the newest version any Intel Mac can run.

Every step below comes from Apple's support articles, compatibility lists, licence and developer documentation, fetched on 23 October 2026.

Key takeaways

• Recovery is the default route. Command-R reinstalls your current macOS, Option-Command-R aims for the latest compatible version, and Shift-Option-Command-R aims for the version the Mac shipped with.
• A USB installer is the backup route. Apple's createinstallmedia command builds one and erases the USB drive.
• Intel support has run out at the top. Apple's macOS 27 compatibility list has only Apple silicon Macs. Tahoe 26 supports four Intel models.
• T2 Macs block USB booting by default. Allow external media in Startup Security Utility for the install, then switch it back.
• FileVault is essential on non-T2 Intel Macs. Apple says they do not encrypt data unless FileVault is on.
• The licence covers Apple hardware only. Apple's macOS licence does not permit macOS on non-Apple-branded computers.
• Check how long your version gets fixes. Apple's security releases page shows each version's last update.

Can you install macOS on a non-Apple PC?

No, not under Apple's terms. The macOS software licence is headed "For use on Apple-branded Systems". In the macOS Tahoe 26 licence, the Other Use Restrictions clause says the grants "do not permit you to, and you agree not to, install, use or run the Apple Software on any non-Apple-branded computer, or to enable others to do so." The System Requirements clause adds that the software "is supported on only Apple-branded hardware that meets specified system requirements as indicated by Apple." The macOS 27 licence uses the same "Apple-branded" wording.

So installing macOS on a Windows laptop or a custom built desktop is out of scope here, and we do not recommend it. You would also lose the protections that come from Apple hardware: installers that fetch firmware for your exact model, Secure Boot on T2 Macs, and hardware backed encryption. If you have a non-Apple PC, install an operating system that supports that hardware, from its official download page.

Which macOS versions still support Intel Macs?

Apple publishes a compatibility page for each major release. Here is what they said for Intel models on 23 October 2026.

macOS 27 Golden Gate: Apple's page says "If you have a Mac with Apple silicon, you can upgrade to macOS 27." Every listed model is Apple silicon, and Apple's security releases page lists macOS Golden Gate 27 as available for Apple silicon Macs only.

macOS Tahoe 26: four Intel models remain: MacBook Pro (16-inch, 2019), MacBook Pro (13-inch, 2020, Four Thunderbolt 3 ports), iMac (Retina 5K, 27-inch, 2020) and Mac Pro (2019). All four have the T2 Security Chip.

macOS Sequoia 15, Sonoma 14 and Ventura 13 each reach further back, as the table shows.

Check your exact model on the Apple page for the version you want. Similar names, such as the two 13-inch 2020 MacBook Pro variants, sit on different lists.

Has Apple said Tahoe is the last release for Intel Macs?

The compatibility lists answer it in practice: macOS 27 lists no Intel models, so Tahoe 26 is the last major version that installs on any Intel Mac. We did not find a sentence saying "last release for Intel" on the Apple support, newsroom or developer pages we fetched, so we report the lists rather than quote a statement we could not confirm.

Apple's developer documentation does give a timeline for Intel apps on Apple silicon, which people often confuse with Intel Mac support. The Rosetta documentation says Rosetta "will be available through macOS 27" as a general purpose tool, with only a subset kept afterwards for older games. The macOS 27 release notes say "All Intel-based software will no longer be compatible with macOS 28." Those statements are about Intel apps on Apple silicon Macs, not about which Intel Macs can install which macOS.

How do you check what kind of Mac you have?

Three facts decide which steps apply: Intel or Apple silicon, T2 or not, and the installed macOS.

Intel or Apple silicon. In About This Mac, an Intel Mac shows Processor followed by an Intel processor name; Apple silicon shows Chip. Apple notes you can safely try either set of Recovery steps if unsure.

T2 or not. Apple's T2 list: MacBook Pro and MacBook Air introduced in 2018 through 2020 (excluding the M1 models), iMac (Retina 5K, 27-inch, 2020), iMac Pro, Mac mini (2018) and Mac Pro introduced in 2019. To confirm, hold Option, choose Apple menu, then System Information, and select Controller or iBridge. "Apple T2 chip" means you have one.

Current macOS. About This Mac shows the version; click it to see the build. In Terminal:

# Current macOS name, version and build
sw_vers

# Which full macOS installers Apple offers for this Mac model (read only)
softwareupdate --list-full-installers

The second command is from Apple's download article. Apple's "Which macOS is the latest?" table listed these latest versions on 23 October 2026: macOS 27.0.1, Tahoe 26.7.1, Sequoia 15.8.1, Sonoma 14.8.9, Ventura 13.7.8 and Monterey 12.7.6.

Before you start: a safety checklist

1. Back up. Apple says reinstalling "doesn't remove your apps or personal data" but still recommends a backup. If you plan to erase, the backup is your only way back.
2. Know your FileVault recovery method. Apple warns that losing both your login password and recovery key means "your files and settings will be lost forever." The installer may ask for your login password to unlock the disk.
3. Know any firmware password. Apple says some startup key combinations do not work while one is set, and a forgotten one means an in-person service visit with proof of purchase.
4. Plug in power. Apple says to let installation finish "without putting your Mac to sleep or closing its lid."
5. Use a simple network. Recovery needs broadband using DHCP over Wi-Fi or Ethernet. Apple says captive network logins, 802.1X security and PPPoE (unless a router handles it) can prevent installation.
6. Use a Mac keyboard, ideally the built-in or a wired one. Apple says PC keyboards and wireless keyboards can miss startup key combinations.
7. Boot Camp users: set the Mac to start from macOS first.

Which install route should you use?

Every route needs an internet connection. Apple's bootable installer article is direct: "You don't need a bootable installer to upgrade macOS or reinstall macOS."

Step by step: reinstall macOS from Recovery on an Intel Mac

These steps combine Apple's "How to start up from macOS Recovery" and "How to reinstall macOS" for an Intel-based Mac.

1. Shut the Mac down. If needed, press and hold the power button for up to 10 seconds. On laptops with Touch ID, that is the power button.
2. Start Recovery. Press and release the power button, then immediately press and hold Command and R until you see an Apple logo or spinning globe.
3. Join a network if asked.
4. Select your startup disk, such as Macintosh HD, if asked, then click Next.
5. Sign in as a user whose password you know, if asked.
6. Choose Reinstall macOS, click Continue and follow the instructions.
7. Unlock the disk if asked, with "the password that you use to log in to your Mac."
8. Choose Macintosh HD if the installer offers it alongside the separate Data volume.
9. Wait. Apple says the Mac might restart several times and the screen "might be empty for minutes at a time."
10. Finish setup, or if handing the Mac on, quit the setup assistant without completing it and click Shut Down.

The Recovery window also offers Restore from Time Machine and Disk Utility, with Terminal in the Utilities menu.

What do Command-R, Option-Command-R and Shift-Option-Command-R install?

Apple's reinstall article spells it out for any Mac that is not Apple silicon:

Note Apple's word "might": the exact version depends on what Apple still serves for your model.

If built-in Recovery fails, Apple says the Mac "should automatically show a spinning globe" and try Internet Recovery. A globe with an exclamation point means that failed too. Apple says that screen and most numbered errors, such as -2001F, -2002F or -2003F, are network problems: try Ethernet, each of the three key combinations, another network, or later.

Other Intel startup keys from Apple's list that help during installs: Option (Alt) opens Startup Manager to pick a USB installer; Shift starts safe mode; Option-Command-P-R resets NVRAM; D or Option-D runs Apple Diagnostics; Command-V shows verbose mode.

How do you do a clean install on an Intel Mac?

A clean install means erasing the startup disk, then reinstalling. Apple's "Use Disk Utility to erase an Intel-based Mac" covers the erase.

Warning: these steps permanently delete every file on the startup disk. Check your backup first and disconnect external drives you do not intend to erase. If you are preparing the Mac for a new owner on macOS Monterey or later, Apple says to use Erase All Content and Settings instead.

1. Start up from macOS Recovery.
2. Select Disk Utility, then click Continue.
3. Select Macintosh HD in the sidebar. If it is missing, shut down, unplug nonessential devices and try again.
4. Click Erase. Name it Macintosh HD and choose APFS or Mac OS Extended (Journaled), "as recommended by Disk Utility."
5. Click Erase Volume Group, or Erase if that button is not shown.
6. Enter your Apple Account details if asked.
7. Quit Disk Utility, select Reinstall macOS and follow the instructions.

If Disk Utility cannot see or erase the disk, Apple says "your Mac might need service."

How do you create a bootable macOS installer with createinstallmedia?

Apple's "Create a bootable installer for macOS" is the source for these steps, which Apple says are "primarily for system administrators and other experienced users."

Step 1: download the full installer from Apple

Apple offers three routes, all from Apple:

• Terminal, on macOS Catalina 10.15 or later, for versions "no earlier than the version that came with your Mac, or the closest version still available."
• The App Store, using Apple's links for High Sierra 10.13 through Sequoia 15. The downloading Mac must be compatible with that macOS, and on Mojave 10.14 or later if you are building a bootable installer.
• A web browser, for Sierra 10.12 and older, as a disk image containing a package.

# See which full installers Apple offers for this Mac model
softwareupdate --list-full-installers

# Download a specific version into /Applications
# (Apple's example version; use one from the list above)
softwareupdate --fetch-full-installer --full-installer-version 26.6.2

If Terminal says "update not found", Apple says "that version of macOS is not available for your Mac." Apple also tells organisations: "Download from Apple, not a locally hosted update server." Never use a third-party mirror, file sharing site or video link for a macOS installer. Apple provides installers through these routes, and a copy from anywhere else is an unknown.

Step 2: check the installer

Apple says the result should be an app named Install plus the version name, such as Install macOS Tahoe, in Applications. If it opens on its own, quit it.

You can also check its code signature. These read only commands come from the codesign manual page shipped with macOS:

# Verify the signature and nested components
codesign --verify --deep --strict --verbose=2 "/Applications/Install macOS Tahoe.app"

# Show the signing chain; Authority lines should end at Apple Root CA
codesign -dvv "/Applications/Install macOS Tahoe.app" 2>&1 | grep Authority

A good result reads "valid on disk" and "satisfies its Designated Requirement". For a browser download, the pkgutil manual page documents a check-signature option that shows a package's signature status and certificate chain. If any check fails, follow Apple's advice for an installer that "does not appear to be a valid installer application": delete it, repair the startup disk, and download again from Apple.

Step 3: prepare the USB drive

Warning: createinstallmedia erases the target volume. Apple says the drive "will automatically be erased" and formatted Mac OS Extended (Journaled). Use a drive with nothing you need, and unplug other external drives.

Apple says a 32GB drive has more than enough space for any macOS installer, and 16GB is enough for most earlier versions. Connect it directly and rename it MyVolume, the name Apple's commands expect. Then confirm the target with read only commands from the diskutil manual page:

# Read only: the USB drive should be the only external disk listed
diskutil list external physical

# Read only: confirm the volume the command will erase
ls /Volumes/MyVolume

Step 4: run Apple's command for your version

Open Terminal, paste the command, press Return, enter your administrator password (no characters appear), and type Y to confirm the erase. Apple's commands for versions an Intel Mac can use:

# macOS Tahoe 26
sudo /Applications/Install\ macOS\ Tahoe.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume

# macOS Sequoia 15
sudo /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume

# macOS Sonoma 14
sudo /Applications/Install\ macOS\ Sonoma.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume

# macOS Ventura 13
sudo /Applications/Install\ macOS\ Ventura.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume

# macOS Monterey 12
sudo /Applications/Install\ macOS\ Monterey.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume

# macOS Big Sur 11
sudo /Applications/Install\ macOS\ Big\ Sur.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume

# macOS Catalina 10.15
sudo /Applications/Install\ macOS\ Catalina.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume

# OS X El Capitan 10.11 (note the extra application path option)
sudo /Applications/Install\ OS\ X\ El\ Capitan.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume --applicationpath /Applications/Install\ OS\ X\ El\ Capitan.app

Apple's article also lists Mojave and High Sierra in the same pattern, and a macOS 27 command, which we leave out because macOS 27 does not install on any Intel Mac. On a Mac running macOS Sierra 10.12.6 or earlier, Apple says to add the application path option as the El Capitan command does.

If Terminal asks to access a removable volume, click OK. If it cannot erase the drive, erase it in Disk Utility as Mac OS Extended (Journaled) and retry. When Terminal says the install media is available, the drive takes the installer's name. Eject it; you can then delete the installer app.

How do you boot an Intel Mac from the USB installer?

Apple's steps for any Mac that is not Apple silicon:

1. Shut down the Mac and connect the installer drive directly.
2. Turn the Mac on and immediately press and hold Option (Alt).
3. Release it when your bootable volumes appear, select the installer, and click the arrow or press Return.
4. Choose your language if asked.
5. Select Install macOS (or Install OS X), click Continue, and follow the instructions.

Two of Apple's warnings matter. The Mac "must be connected to the internet so that the installer can get firmware and other information specific to this Mac model", so a USB installer is not an offline installer. And if the macOS is incompatible, the Mac "might start up to a circle with a line through it."

If a T2 Mac will not start from the installer, Apple says to check that Startup Security Utility allows external or removable media.

What does Startup Security Utility do on a T2 Mac?

On an Intel Mac with the T2 chip, Startup Security Utility controls a firmware password, Secure Boot and allowed boot media. Apple says its purpose is to make sure the Mac "always starts up from your designated startup disk, and always from a legitimate, trusted operating system."

To open it: start up from Recovery, choose Startup Security Utility from the Utilities menu, click Enter macOS Password, and authenticate as an administrator.

Apple says Medium Security "doesn't prevent your Mac from using an OS that is no longer trusted by Apple." Under Full Security, if FileVault is on while integrity information downloads, you enter a password to unlock the disk. If the OS fails verification, the Mac offers to open the macOS installer. Keep Full Security unless you have a specific, temporary reason to lower it.

Allowed boot media. Apple says the default, most secure setting disallows external or removable media. Allow it for your USB install, then change it back. T2 Macs do not boot from network volumes whatever this says.

Firmware password. Apple says a firmware password, available only on Intel Macs, stops anyone without it from starting up from Recovery or any disk other than the designated startup disk; on Apple silicon the equivalent is FileVault. With one set, the Mac asks for it to start from another disk, start Recovery, or use Erase All Content and Settings on a T2 Mac. To set it, open Startup Security Utility (or Firmware Password Utility), click Turn On Firmware Password, set it and restart. Apple's only fix for a forgotten one is an in-person service appointment with the original receipt or invoice.

How should you set up FileVault after installing?

Apple's macOS User Guide draws the line by hardware. On Apple silicon or T2 Macs "your data is encrypted automatically", and FileVault adds the requirement of your login password. "If you use a Mac that doesn't have Apple silicon or the T2 chip, you need to turn on FileVault to encrypt your data." On the 2017 and 2019 iMacs in the table above, a disk without FileVault is not encrypted at all.

1. Open System Settings, then Privacy and Security, then FileVault. You must be an administrator.
2. Turn on FileVault.
3. Choose to let your iCloud account unlock the disk, or create a recovery key and not use iCloud.
4. If you create a key, copy it exactly and keep it "somewhere other than your encrypted startup disk", away from the Mac.
5. Click Continue, and use Enable Users for other accounts if shown.

fdesetup status in Terminal confirms the state, per its manual page. Our posts on checking whether FileVault is on and choosing between iCloud and a recovery key go deeper.

How does Erase All Content and Settings work on Intel Macs?

Erase All Content and Settings erases data, settings and apps but keeps the installed macOS. Apple says it "requires macOS Monterey 12 or later and a Mac with Apple silicon or Mac with the Apple T2 Security Chip." Among Intel Macs, only T2 models on Monterey or later have it.

Warning: this erases all of your data. Back up or transfer your files first.

1. Open System Settings, then General, then Transfer or Reset. On Monterey, use the System Preferences menu instead.
2. Click Erase All Content and Settings.
3. Enter your macOS user password, then your Apple Account password.
4. Confirm, and ignore any prompt to sign back in to your Apple Account.
5. The Mac restarts, activates and opens the setup assistant. If you are selling it, do not continue; hold the power button until it turns off.

If told other volumes must be erased, Apple says you may have a Boot Camp Windows partition to remove with Boot Camp Assistant.

Intel Macs without a T2 chip use Apple's older route from "What to do before you sell": sign out of iCloud and iMessage (and iTunes before Catalina), start up from Recovery, erase with Disk Utility, reinstall macOS, press Command-Q at the setup assistant, then reset NVRAM, which Apple says "restores certain security features that might have been altered." Our post on deep clean and secure delete on macOS explains why a non-T2 Mac that never had FileVault on is the weakest case for a full erase.

How do you verify the install?

# Version and build now running
sw_vers

# FileVault state
fdesetup status

# Outstanding Apple updates for this Mac
softwareupdate --list

Then check Software Update in System Settings, which Apple says "shows only updates that are compatible with your Mac." On a T2 Mac, restart into Recovery and confirm Full Security in Startup Security Utility, with external boot media disallowed again. Compare your version with Apple's latest version table: for Tahoe on 23 October 2026, that was 26.7.1.

How do you keep macOS patched, and what happens when support ends?

Apple calls updating "the most effective way to stay secure." Major versions arrive roughly yearly and minor releases through the year carry security fixes. Apple adds that it "continues to offer security updates to the previous major operating system version for a period of time." The pages we fetched give no fixed length for that period, so judge it from Apple's security releases page. On 23 October 2026 it showed:

Ventura's latest version, 13.7.8, is also its last entry on that page. An Intel Mac that cannot go past Ventura has had no listed macOS security update for over a year. That is what end of support looks like in practice.

Install updates through System Settings, General, Software Update, and turn on automatic updates there. When an Intel Mac stops getting fixes:

1. Move to the newest macOS it supports while that version still gets updates.
2. Replace it for anything that handles work data, credentials or code signing.
3. Repurpose it for low risk tasks, kept off networks where it can reach sensitive systems.
4. Run another operating system that supports the hardware, from that project's official download page.

Do not keep an unpatched Mac as a daily developer machine. Its SSH keys, tokens, package caches and signing material are only as safe as the operating system underneath.

How do you uninstall or downgrade macOS?

There is no macOS uninstaller. Removing it means erasing the startup disk; going back means erasing, then installing the older version.

• Recovery: Shift-Option-Command-R might offer the macOS the Mac came with, or the closest available.
• USB installer: build one for the older version from Apple's routes, erase, then install.
• Your files: use Restore from Time Machine in Recovery with a backup made on that version.

Warning: every downgrade path erases the startup disk. Older major versions may also get security fixes for less time, as the table above shows.

Common errors and fixes

If nothing works, Apple's install error article says to erase the Mac and reset it to factory settings, then contact Apple Support.

Common mistakes

• Downloading an installer from anywhere but Apple. Use Software Update, Recovery, the App Store, Apple's browser links or softwareupdate.
• Running createinstallmedia with other drives attached. It erases whatever is mounted as MyVolume.
• Expecting the USB installer to work offline. Apple says the Mac must be online for firmware and model information.
• Leaving Secure Boot lowered. Allow external media for the install, then restore the defaults.
• Skipping FileVault on a non-T2 Intel Mac. Without it, the disk is not encrypted.
• Losing the recovery key or firmware password. Either can lock you out for good.
• Installing macOS on a non-Apple PC. Apple's licence does not permit it.
• Staying on an unsupported version for daily work. Check your version's last update date.

Where Safeguard fits, honestly

Safeguard is a software supply chain security platform. It does not install macOS, manage Macs, check Secure Boot or protect endpoints, and none of the steps above depend on it. The connection is narrower. A freshly installed Mac becomes a developer machine again by pulling lockfiles, global packages, SDKs and container images back from registries, which is when an old vulnerable dependency quietly returns. Scanning each project on the rebuilt Mac with the Safeguard CLI, or through the local runner and offline mode, shows which component versions you installed and which known vulnerabilities apply before that Mac builds and ships code. Our post on the Safeguard CLI as a security aware coding assistant covers that workflow.

FAQ

How do I reinstall macOS on an Intel Mac without losing data?

Hold Command-R as the Mac turns on to start macOS Recovery, then choose Reinstall macOS. Apple says reinstalling does not remove your apps or personal data. Only erasing the disk in Disk Utility removes files, but back up first anyway.

What is the latest macOS for Intel Macs?

macOS Tahoe 26, on four models: MacBook Pro (16-inch, 2019), MacBook Pro (13-inch, 2020, Four Thunderbolt 3 ports), iMac (Retina 5K, 27-inch, 2020) and Mac Pro (2019). Many other Intel Macs top out at Sequoia 15.

Can I install macOS 27 on an Intel Mac?

No. Apple's macOS 27 Golden Gate compatibility page lists only Apple silicon Macs, and its security releases page lists macOS 27 for Apple silicon only.

What is the difference between Command-R and Option-Command-R?

Command-R uses built-in Recovery and reinstalls the current version of your most recent macOS. Option-Command-R uses Internet Recovery and might offer the latest macOS compatible with your Mac.

How do I make a bootable USB installer for macOS?

Download the full installer from Apple, rename a USB drive MyVolume, and run Apple's createinstallmedia command for your version in Terminal. The command erases the drive. Apple says 32GB is more than enough.

Why won't my Intel Mac boot from the USB installer?

On a T2 Mac, external boot media is disallowed by default; allow it in Startup Security Utility. Also hold Option at startup, connect the drive directly, and check the macOS is compatible with your Mac.

Can I install macOS on a Windows PC?

Not under Apple's licence, which says you agree not to "install, use or run the Apple Software on any non-Apple-branded computer." For a non-Apple PC, use an operating system that supports that hardware.

Do Intel Macs need FileVault?

Yes. Apple says Macs without Apple silicon or a T2 chip must turn on FileVault to encrypt data at all. On T2 Macs, FileVault adds your login password to the protection.

How do I wipe an Intel Mac before selling it?

On a T2 Mac with Monterey or later, use Erase All Content and Settings. Otherwise, sign out of iCloud and iMessage, erase with Disk Utility from Recovery, reinstall macOS, press Command-Q at setup, and reset NVRAM.

Fix it without waiting for upstream

A freshly installed Mac does not rebuild its software from memory. It pulls the same open source dependencies, toolchains and container images back from package registries, and any vulnerable version pinned in a lockfile comes back with them. Nothing below touches macOS itself, but the moment after a clean install is when dependency hygiene matters most.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos install macOS or change startup security. They show the software side of a reinstalled Mac back in use for development. To try the CLI, download Safeguard and follow the CLI setup guide.

The first demo is a real CLI session: safeguard opens the interactive terminal, you ask it to fix the lodash CVE in a repo, and it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, and pushes nothing. On a freshly installed Mac, the same flow catches a vulnerable version that came back with the first npm install.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code, and scans from the terminal. After a clean install, this gets dependency inventory and vulnerability checks running on the rebuilt Mac while project code stays on that machine.

Click through it at your own pace, or open it full screen.

The third demo shows the desktop app sending work to a computer running the CLI, with each command approved before it runs. If you look after several reinstalled Macs for a small team, that approval step keeps a person in charge of what runs on each.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Apple Support: How to reinstall macOS (102655)
• Apple Support: How to start up from macOS Recovery (102518)
• Apple Support: Create a bootable installer for macOS (101578)
• Apple Support: How to download and install macOS (102662)
• Apple Support: Mac startup key combinations (102603)
• Apple Support: macOS 27 Golden Gate is compatible with these computers (127255)
• Apple Support: macOS Tahoe 26 is compatible with these computers (122867)
• Apple Support: macOS Sequoia is compatible with these computers (120282)
• Apple Support: macOS Sonoma is compatible with these computers (105113)
• Apple Support: macOS Ventura is compatible with these computers (102861)
• Apple Support: Find out which macOS your Mac is using (109033)
• Apple Support: Mac computers with Apple silicon (116943)
• Apple Support: Mac computers with the Apple T2 Security Chip (103265)
• Apple Support: About Startup Security Utility on a Mac with the Apple T2 Security Chip (102522)
• Apple Support: Set a firmware password on your Mac (102384)
• Apple Support: Use Disk Utility to erase an Intel-based Mac (102639)
• Apple Support: Erase your Mac and reset it to factory settings (102664)
• Apple Support: What to do before you sell, give away, trade in, or recycle your Mac (102773)
• Apple Support: If an error occurred while updating or installing macOS (102531)
• Apple Support: How to revive or restore Mac firmware (108900)
• Apple Support: Update macOS on Mac (108382)
• Apple Support: About Apple software updates (125039)
• Apple Support: Apple security releases (100100)
• macOS User Guide: Protect data on your Mac with FileVault
• Apple: Software License Agreement for macOS Tahoe 26 (PDF)
• Apple: Software License Agreement for macOS 27 (PDF)
• Apple Developer: About the Rosetta translation environment
• Apple Developer: macOS 27 Golden Gate release notes
• Manual pages installed with macOS 27: man softwareupdate, man codesign, man pkgutil, man diskutil, man fdesetup

Last reviewed: 23 October 2026. Apple changes compatibility lists, install steps and security update coverage over time; check the linked Apple pages before you erase anything.