Report a vulnerability
Email versydev@pm.me with the affected version, a minimal reproduction, expected and observed behavior, and the likely impact. Darko Klincharski is the creator, main contributor and maintainer.
Keep reports private. Do not include live credentials, private source, personal data, or working secrets in public discussions. Agree on a safe transfer method before sending sensitive proof-of-concept material. No response-time guarantee or bug bounty is currently published.
The release's SECURITY.md is the versioned reporting policy.
Release and source checks
Download artifacts from one version and verify their SHA-256 checksums before installation. The source viewer verifies text previews against the supplied catalog; it renders file content as text. A matching hash checks integrity against the published metadata, not independent publisher authentication.
0.3.0 is an experimental preview. Its public provenance describes the tested platform and export transformations. Signing, notarization, cross-host reproducibility, and authenticated multi-user operation are not claimed.
Local repository boundary
Actor identities and Evidence are recorded declarations and attestations. VERSY does not authenticate their producer or execute external tests. Use OS account isolation and protected backups for valuable work.
Review Capture Policy and actual bytes before capture. Already tracked files can contain secrets, and a subsequent deletion does not erase immutable history. If a secret is captured, revoke it first; follow the operational guidance.