Security at Varve
Report a vulnerability privately
Email security@varve.studio or use GitHub Private Vulnerability Reporting. Do not post sensitive vulnerability details in public GitHub issues or discussions.
Helpful reports include the affected version, vulnerability class, reproduction steps, likely impact, and a proof of concept where it is safe to provide one. Please avoid destructive testing and unnecessary personal data. We coordinate disclosure with the reporter.
Download integrity
Varve builds are not currently code-signed. The release still publishes integrity metadata for independent verification.
- SHA-256 checksums for published build artifacts
- SBOMs and build provenance for release artifacts
- Published downloads linked from the official GitHub repository
Until code signing is available, verify published checksums and SBOMs, or build from source. See the download page for current release information.
Local-first data handling
Core design data stays on your device by default. Varve has no required account or cloud storage. Optional network features, diagnostics, and crash reporting are separate choices; review the Privacy Policy before enabling them.
Security documentation
The repository's security policydescribes scope, supported versions, and the handling process. The machine-readable disclosure endpoint is security.txt.