Critical security alert on Google account, suspicious app detected

Make sure you use OAuth2 with Gmail if you do not already do this. Password access could probably trigger something like what you describe. At least in the past it would some times require the user to log in using webmail.

If you already use OAuth2 then we should try to figure out what's going on.

I did indeed use OAuth (redirected to browser, token created, back to MM). The strange thing is that only MailMate vanished from Google's allowed 3rd party apps, twice. I was able to add it back again, though. It works now, but I suspect the warning was issued by MailMate. Little Snitch tells me that the code signature is invalid/modified, but I am not sure whether that's always been that way?

Note that I am not certain that MailMate is the cause, it just seems to be the only connection that could have triggered it as far as I know.

Though, I noticed that Google has once again removed MM from the list of allowed 3rd party apps.

Do you have OAuth2 enabled for both IMAP and SMTP?

I don't see how the code signature could be related to OAuth2, but this should also not happen. Maybe you should re-download MailMate, but first make sure you haven't made any changes within the application bundle which you need (you should never do this, but it's possible).

You can try the latest test release of MailMate like this: Hold down the option key when clicking “Check Now” in the Software Update preferences pane.