Every score on this site is computed from fields in a publisher's own manifest. Nothing is editorial, nothing is a vibe, and no vendor can pay to change a number. The full breakdown is printed on each software page so you can disagree with it line by line.
The share of a program’s installers that ship a published SHA-256 hash.
Without a hash there is no way to prove the file on your disk is the file the publisher built. This is the single thing that turns a download into a verifiable download.
Whether each installer URL sits on the publisher’s own domain, on a domain we have verified the publisher owns, on a recognised distribution platform such as GitHub or a contracted CDN, or on an unrelated third party.
This is the strongest signal against a repackaged installer. It is also the one that takes real work: large vendors serve from their own CDN domains, so a naive domain comparison would wrongly punish Microsoft, Spotify or Valve. We keep a hand-verified map of publisher-owned domains instead.
The share of installer URLs using HTTPS.
An installer fetched over plain HTTP can be modified in transit by anyone on the path.
How long ago the latest version shipped, when the manifest declares a release date.
Software that has not shipped in years accumulates unpatched vulnerabilities.
Whether the manifest states a licence.
A declared licence tells you what you are actually allowed to do with the software. It is a small signal, weighted small.
A missing field is not a penalty. If a manifest declares no release date, the recency signal is dropped from the total rather than scored as zero, and the remaining signals are normalised to 100. An incomplete manifest means we know less about the program, not that the program is suspect. Scoring it as a failure would measure metadata quality and call it safety.
The score summarises, the warnings inform. Because we index well-known software from an official repository, most programs score high, and a number that is almost always green tells you nothing. So read the warnings first. Right now 3 of 177 programs carry one, and they are listed on the front page.
Windows data comes from Microsoft's winget-pkgs repository. macOS data comes from the Homebrew cask index. Every software page links to the exact manifest it was built from.
If a score is wrong, it is usually because a publisher serves from a domain we have not yet verified as theirs. That is a data problem on our side and we want to know about it.