Security

Reporting an issue and checking the file you downloaded.

Responsible disclosure policy draft — pending review. Contact, scope and process are not yet finalized.

How to report

Security contact: [to be added after review]. This placeholder is not a reporting channel. Do not share passwords, access keys or personal data in the general contact form or a public issue.

Include the affected component, reproduction steps and potential impact. No response time, reward or safe-harbor terms are committed yet.

Proposed scope

StrukLabs website
Account and sign-in
Hub
Harness Studio

Use your own account and data; do not access others’ data, disrupt services or use social engineering.

Verify downloads

Download from the official GitHub repository’s release page. Match the file name, version and system.
If the same release publishes a SHA-256 checksum for your file, calculate it with the appropriate command below and compare every character.
If the values differ, do not run the file. Without a published checksum, this check is unavailable.

Windows PowerShell

Get-FileHash -Algorithm SHA256 .\downloaded-file.exe

macOS

shasum -a 256 ./downloaded-file.dmg

Linux

sha256sum ./downloaded-file.AppImage

Update signatures

Update signatures supplied by the release manifest appear on the download page. An update signature is separate from a SHA-256 checksum and OS code signing. The presence of signature text alone does not verify a file; verification requires a trusted public key and compatible verifier. This draft does not yet publish those.

The Windows installer is not yet code-signed according to the README. A matching checksum does not verify a Windows publisher identity.

Official releases Download page