Security

The current Windows early release is unsigned. Its published SHA-256 checks the downloaded bytes, but a checksum alone does not prove publisher identity. Signed production packages remain a separate release gate.

Before installing

Checks before installation

01
Download only from the versioned GitHub release record linked on the Download page. Confirm that the release tag matches the site.
02
Compare the local ZIP’s SHA-256 with both the site and the release checksum file. A matching hash detects an altered or incomplete download; it is not a signature.
03
Expect an unsigned-app warning on Windows. Do not treat that warning as proof of safety. Signed, timestamped packages will have a separate publisher check when released.

Application boundary

How the local application is isolated

EVT listens only on your computer, never on your LAN or the public internet.
The website cannot reach, control or administer a running EV installation.
Credentials are protected per installation and are never built into the installer.
EVT is read-only decision support. It does not place, change or cancel EVE orders.

Report privately

Found a security problem?

Do not post credentials, character data or a working exploit in a public issue. Use the repository’s private security-advisory channel. Do not share sensitive data with an issue report.

Open a private security advisory

Include the EVT version, operating system, affected feature, reproduction steps and likely impact. Remove tokens, keys, cookies and private EVE data.

View supported releases