Verify Security Overview

Verification model

The default upload flow runs locally in the browser. The selected ZIP does not need to be transmitted to the Verify server for client-side validation.

• Browser-side verification checks signatures, manifests, and trust material locally.
• Public verification slugs expose only material intended for public verification.
• Verify depends on separately obtained issuer keys and Registry trust material rather than a private account session.

Service protections

• Verify uses HTTPS and restrictive browser security headers.
• The public Verify surface is read-only and does not mutate customer data or billing state.
• Operational logging, request tracing, and abuse controls protect service availability.
• Issuer-key material is obtained separately for receipt checks. A package is not recorded in a public log.

What Verify does not claim

• Verify is not a compliance certification service.
• It does not prove that the submitter's controls are effective beyond the cryptographic evidence actually presented.
• It does not replace independent legal, procurement, or audit review.

Security reports for Verify should be sent through the Verify-specific disclosure page at /vulnerability-disclosure.