Reports are emerging that Apple's code signing API as implemented by third party anti malware tools including Google Santa, Facebook OSquery, Little Snitch, xFence, Yelp’s OSXCollector, and more allowed unsigned code to pass checks by simply being bundled with code already signed by Apple (archived). This is being framed by parties involved as well as the mainstream tech press as a problem in how all of these third parties implemented the API and not Apple's API or Apple's documentation.