Trust and safety
How we verify apps
Every version of every app goes through these checks before you can download it from AppsXi. Each listing shows the results for the exact file you get.
1. Official file only
For open source apps, AppsXi downloads the maintainers' own release file from GitHub. We never rebuild, repackage, or re-sign it, so the signature still names the people who made it.
2. Hash check
GitHub publishes a SHA-256 hash for each release file. We confirm the file we checked matches it, record the hash, and show it on the listing. If the file on GitHub ever changes after we checked it, the listing is frozen until a person reviews it.
3. Malware scan
The file and everything inside it is scanned with ClamAV, with signatures updated daily. Any detection blocks the listing.
4. Signature and notarization
Mac apps must be signed with an Apple Developer ID and notarized by Apple. Windows installers must carry a valid Authenticode signature from a trusted certificate. Unsigned apps are not listed.
5. Signer pinning
The first time we list an app, we record who signs it. If a later version is signed by someone else, the update is blocked. This protects you if a project's account is ever taken over.
6. Code integrity
On Mac we check Hardened Runtime and look for risky entitlements, such as ones that let other programs inject code, and for library paths that point to folders anyone can write to. On Windows we check that bundled programs are signed and built with ASLR and DEP. For Electron apps we read the security fuses.
7. Build provenance
Some projects build their releases with GitHub Actions and publish a signed record of the build, called an attestation. When one exists for the exact file, AppsXi checks its signature and certificate chain and shows where the file came from: the repository, tag, commit and workflow. For GitHub's immutable releases, GitHub itself signs that the file belongs to the release, so it cannot be swapped later; listings show that too.
8. Install and behavior test (coming soon)
The next step is installing each app in a clean virtual machine and watching what it does on first launch. Listings say plainly that this test has not run yet.
Developers and updates
Verified by AppsXi means a developer passed an identity check and agreed to AppsXi's distribution agreement. Trusted Publisher adds a track record: at least 90 days on AppsXi, 50 or more sales, few refunds, replies to buyers within 3 business days, and no strikes or frozen builds. It is checked every day and removed when a developer stops meeting it.
Updates to popular apps roll out in steps: by default 1% of copies get a new version first, then 10% a day later, and everyone a day after that, so a bad release can be stopped before it reaches most people.
What these checks do not promise
No set of checks can prove an app is free of every bug or bad behavior. Open source apps are made by their maintainers, not by AppsXi, and many update themselves from the maintainers' own servers; listings say when they do. If something looks wrong, please report it. Malware reports go to the front of the queue.