Obsidian
Obsidian stores notes on your Mac and lets you link them together to organise information. It’s made by Dynalist, based in Canada.
Criminals have used its name in fake downloads or scams, so get it only from obsidian.md.
What it is
People use Obsidian for notes, research and writing. It saves notes as plain text files in folders called vaults. You can link notes together and search them.
It reads and changes files in your vault to display, edit and organise your notes. It works offline without an account. Optional services sync notes between devices or publish them online. Its audio recorder can save microphone recordings into notes.
Obsidian publishes independent security audits. Community plugins are disabled by default through Restricted mode. If enabled, these add-ons inherit the app’s access and can read files, connect to the internet and install other programs.
Who makes it
Dynalist is a Canadian software company whose team started Obsidian in 2020. Its legal name is Dynalist Inc.. Its website is dynalist.io.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Obsidian. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is md.obsidian. Download it only from obsidian.md, not from an ad or a link someone sends you.
Fakes. In September 2024, researchers documented lookalike download sites offering trojanised Obsidian installers. In April 2026, Elastic reported attackers using shared vaults and altered community plugins to deliver malware on Windows and macOS after persuading people to enable plugin synchronisation.
What it connects to
In normal use, Obsidian talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
github.com | Public updates, plugins and themes |
raw.githubusercontent.com | Plugin safety lists and community files |
api.obsidian.md | Account and licence management |
sync-*.obsidian.md | Optional note synchronisation |
publish-main.obsidian.md | Optional note publishing |
publish-*.obsidian.md | Optional publishing servers |
publish.obsidian.md | Published note websites |
releases.obsidian.md | Early access updates |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Microphone | To record audio and save it in your notes when you use the audio recorder. |
Security record
Problems with Obsidian or Dynalist in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| CodeAnt reported that clicking a malicious equation link could run commands on the computer (CVE-2026-104078), and the flaw remained reproducible in its tested 1.14.x release. | ↗ | |
| A crafted note could run commands when someone started its slide presentation (CVE-2026-104077); the public 1.14 release included a fix. | ↗ | |
| Cure53 found a critical flaw allowing malicious bookmarks to run scripts in the built-in web viewer; Obsidian fixed it and Cure53 verified the fix. | ↗ | |
| Obsidian 1.5.3 fixed four audit findings, including unauthorised file reading and writing, and Cure53 verified the fixes. | ↗ |
References
- Obsidian macOS bundle metadata doesitarm.com
- Obsidian terms of service obsidian.md
- About Obsidian obsidian.md
- Dynalist official website dynalist.io
- Download Obsidian obsidian.md
- How Obsidian stores data obsidian.md
- Obsidian security obsidian.md
- Plugin security obsidian.md
- Audio recorder obsidian.md
- Deploy Obsidian across your team obsidian.md
- Security considerations for teams and network connections obsidian.md
- Obsidian changelog obsidian.md
- Obsidian impersonation phishing campaign solothreats.com
- Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT elastic.co
- From Markdown to a Shell: Two RCEs in Obsidian Desktop codeant.ai
- Obsidian 1.14 Desktop release notes obsidian.md
- Cure53 Obsidian clients and UI audit, September 2024 obsidian.md
- First independent Obsidian security audit and fixes obsidian.md