Trust and verification
AI can help write the code. People must earn the trust. This page explains what our verification words mean, and shows the evidence that exists today, including where there is none yet.
Each word below means something specific. None of them means “perfect”, and some of them are often confused.
Tells you: Anyone can read the code, under a recognised open-source licence.
Does not tell you: That the code is good, safe, or does what it says.
Claimed by: A public repository with a licence file.
Tells you: At least one person other than the author read the change and approved it.
Does not tell you: That the reviewer ran it, or that it is free of security flaws.
Claimed by: A maintainer, recorded on the pull request.
Tells you: The automated tests and checks ran and passed for that exact version.
Does not tell you: That the tests cover what matters, or that a person tried it.
Claimed by: A linked continuous integration (CI) run.
Tells you: A named person used the software for specific tasks and wrote down what happened.
Does not tell you: That every device, situation or kind of user was covered.
Claimed by: A tester's dated report.
Tells you: Keyboard, screen reader, contrast and other checks were carried out, with results.
Does not tell you: Formal conformance or certification, unless the review says so.
Claimed by: A dated review that states its scope.
Tells you: Someone looked for vulnerabilities within a stated scope.
Does not tell you: That the software is secure. No review can prove that.
Claimed by: A named reviewer, with the scope and limits written down.
Tells you: A qualified party with no stake in the project reviewed it.
Does not tell you: Anything outside the scope of the audit, or anything changed after it.
Claimed by: The auditor's published report.
Tells you: A named human maintainer decided this version can be released.
Does not tell you: That it has no bugs.
Claimed by: A person. Never an AI tool.
Please do not post vulnerabilities, passwords, keys or personal information in public issues or comments.
A confidential reporting channel has not been published yet. The draft security guidance says one must exist before detailed reports are invited. Until then, you can open an issue asking for a private contact, without including any details of the problem.
Recorded checks for every listed project. “Not started” means no public evidence has been recorded yet.
Source code published
No application repository has been created yet.
Automated checks
There is no code to check yet.
Human testing
The research plan starts with interviews and observed tasks with prospective users.
Accessibility review
Security and privacy review
Release approval
Code, secrets and permissions review
Required before any transfer.
Licence and rights check
Release approval
Only adopted projects can have releases.
Code, secrets and permissions review
Required before any transfer.
Licence and rights check
Release approval
Only adopted projects can have releases.
Threat model
Independent security review
Release approval
Only adopted projects can have releases.
Boot test on a device or virtual machine
Licence and rights check
Release approval
Only adopted projects can have releases.
Rights check for code, art, music and characters
Code, secrets and permissions review
Release approval
Only adopted projects can have releases.
Automated checks were run while this website was being built: a production build, code linting, measured colour contrast, keyboard testing and an automated accessibility scan. They were run by Claude, not by an independent reviewer. The founder approved the site for publication on 14 November 2026.
