Trust / Security

Security policy

Block Engine is a local-first execution engine. Security reports are handled through the public repository with a private channel for vulnerabilities.

Report a vulnerability

Please do not disclose an exploitable vulnerability in a public issue. Use a private GitHub Security Advisory and include the affected version, edition, operating system, minimal reproduction, impact, and sanitized logs.

What to protect

Reports involving process execution, path traversal, state injection, installer behavior, runtime isolation, or secret exposure are especially useful. Do not upload credentials, certificates, private keys, or malicious samples containing real user data.

Release verification

Release artifacts are published through GitHub Releases with a SHA-256 manifest and GitHub build attestations. Block Setup downloads only the matching official release package, verifies its checksum, never runs runtime installers, and makes PATH or file-association changes only when the user selects them. Read the code signing policy before publishing or installing a Windows executable.

Machine-readable policy

The public machine-readable policy is available at /.well-known/security.txt.