Code signing policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

What is signed

Breached's own Windows files: the installer BreachedSetup-<version>.exe and the breached.exe launcher inside it and inside the portable zip. They are built from the source in the breached repository by its GitHub Actions release workflow, and only those build outputs are sent for signing. The Firefox engine files Breached runs on are Mozilla's own and keep Mozilla's signature.

Every release is signed only after a person approves the signing request.

Team roles

• Committers and reviewers: tacobellerontop-sudo
• Approvers: tacobellerontop-sudo

Changes from anyone outside the team are reviewed before they are merged.

Privacy

Breached does not send any information to the Breached project. What it does send, to whom, and how to turn it off is in the privacy policy.