Yes, using Activity Monitor, as a sibling mentioned. I have done this regularly over the years and my conclusion is that virtually no app distributed outside the App Store does this. Even when they have an App Store counterpart (example: 1Password).

Hence, I have decided to always purchase the App Store version of an application when available and to think twice if there is no App Store version. I do not want to give a random developer full access to my filesystem.

> I do not want to give a random developer full access to my filesystem.

Surely an app can only do that if it requests escalated privileges. By default, I would expect it to have the same filesystem permissions as the user that launches it.

The default permissions of the (typical Mac home) user are: read access to most of the filesystem, write access to the full home directory, /Applications, and some other locations.

So that's not "full access to my filesystem" by any means. Maybe there could be a bit more nuance, but I don't think this is an unsolvable problem.

There's a "Sandbox" column that can be enabled in Activity Monitor. Probably the easiest way short of terminal commands

Easiest way is to use the app "RB App Checker Lite", and check if all the binaries in the app are sandboxed, and what permissions they have.

Not really

depends on the app and what it is trying to do but no clear indication.