Security and disclaimer

Automated checks

For each file in a release, the service records the SHA-256 digest that GitHub publishes and looks it up in MalwareBazaar, a database of known malware samples. Files are not downloaded by the service.

A release is shown as checked only after every file has a lookup result. Releases that are waiting for checks, or whose checks failed, are not listed. When a new release is under check, the previously checked release stays listed.

A file reported as malicious suspends the plugin.

Limits of the checks

The checks detect only threats already known to these databases. New or targeted malware may not be detected, so use plugins carefully even when nothing is detected.

The digest identifies the file that GitHub served when it was recorded. Compare the SHA-256 of the file you download with the value shown here.

Disclaimer

This platform is provided as is, without warranty of any kind, so install plugins at your own risk. The authors of each plugin are responsible for their software.