Code signing policy
Who builds Vaultify, who may sign it, and how to check that the file you downloaded is the one that was built.
Last updated: 27 October 2026 · Applies to the Vaultify releases published at github.com/niyexdroid/vaultify/releases.
Current status: not signed yet
Vaultify's Windows installer is not code-signed at the time of writing, so Windows SmartScreen reports an unknown publisher. An application for free open-source signing through SignPath Foundation is in progress. Until it is granted, the only way to confirm a download is the SHA-256 check below.
Who produces the builds
Every published file is built by GitHub Actions from the
public source of this project, using the workflow at
.github/workflows/build.yml.
No file is ever built on a personal machine and uploaded by hand. The workflow
runs flutter analyze and flutter test first and
packages nothing if either fails.
A release is produced only by pushing a version tag such as
v1.0.0, which the workflow turns into the version number carried
by the installer and the app. The run that produced each release is visible in
the repository's Actions
history to anyone who wants to read it.
Who may authorise a signature
One person maintains this project and is the only one who can authorise a release or a signature: Adegbola Adeniyi (@niyexdroid), the repository owner. There are no other maintainers, and no one else has write access.
Multi-factor authentication is required on that GitHub account. Signing credentials are held as repository secrets, are never written into the source, and are only reachable by the release workflow running on a version tag.
What the signature will mean
Under the SignPath Foundation programme, the certificate is issued to SignPath Foundation rather than to this project, so that is the publisher name Windows will show. The signature says the file came from this project's automated build of its public source — it is not a claim by SignPath Foundation, Microsoft or anyone else about what the software does.
Signing will cover the Windows installer. The macOS and iOS builds stay unsigned until there is an Apple Developer account, and the Android APK is signed with this project's own upload key.
Verifying a download yourself
Each release page lists the SHA-256 hash of every file. Comparing the hash of your download against that list proves the file arrived intact and unmodified. In PowerShell:
Get-FileHash .\Vaultify-1.0.0-Setup.exe -Algorithm SHA256
On macOS or Linux:
shasum -a 256 Vaultify-1.0.0.apk
If the result does not match the hash on the release page, delete the file and download it again from the releases page only. Do not install it.
Reporting a problem
If you find a file whose hash does not match, a release you cannot account for, or anything that suggests a signature has been misused, please open an issue in the GitHub repository.