Sandbox settings
Runtime controls
The upload flow exposes the same runtime controls the backend validates before creating or reusing a sandbox execution.
Runtime target
Controls the VM runtime selected for the detonation.
- Visibility
- Public scans can appear on shared scan reports. Private scans stay scoped to the account or tenant.Private analysis requires a paid plan.
- Operating system
- Choose macOS 26 Tahoe, macOS 15 Sequoia, or macOS 14 Sonoma.Free runs use macOS 26 Tahoe.
- Architecture
- Run in Apple Silicon ARM64 or Intel x86_64 (coming soon) environments.Intel x86_64 (coming soon) requires a paid plan.
- Execution timeout
- Free runs are capped at 30 seconds, Analyst at 300 seconds, and Team and Enterprise at 600 seconds.
Launch behavior
Controls how the sample starts and where it starts from.
- Auto settings
- Let Bintracer pick a realistic launch path based on sample type.
- Execution method
- Auto, Direct, Open via LaunchServices, Shell via /bin/zsh, or Terminal via a .command wrapper.
- Current directory
- Launch from ~/Downloads, ~/, /tmp, or a custom absolute or home-relative path.Custom directories require a paid plan.
- Execute with sudo
- Run the sample with elevated privileges when a format or behavior requires it.
Instrumentation
Controls signing, SIP, external monitoring, and entitlement changes.
- Disable SIP
- Disable System Integrity Protection (SIP) inside the sandbox runtime.Disabling SIP requires a paid plan.
- Library monitoring
- Observe dynamic library loads using function hooks.
- Force apply ad-hoc signature
- Sign the sample to allow unsigned execution and optional entitlement changes without disabling SIP.
- Hardened runtime
- Sign the sample using the hardened runtime flag.
- Extra entitlements
- Include security-relevant entitlements in the ad-hoc signature.