Is PhotoCraft safe? Official sources and file verification

Can this site confirm PhotoCraft is safe?

No. We have checked official documentation and release metadata, not executed or scanned the installers, audited the code or tested hostile documents. Open source, a published release and a matching checksum are useful evidence about provenance or integrity; none establishes freedom from vulnerabilities or malicious behaviour.

Start with the official app and repository

Follow getartcraft.com/apps/photocraft to the storytold/photocraft repository and its Releases. Confirm the repository owner, release version, CPU, platform and exact asset filename before downloading. A search ad, similar name, source-code archive or unofficial mirror is not the same desktop file. This site links official sources and does not host installers.

Compare the downloaded file with the same release

Find SHA256SUMS.txt among the assets for the exact release you selected, not another version. In the folder containing your downloaded file, calculate SHA-256 with the command for your system below. Examples use the currently recorded official filenames; substitute your actual filename if you chose a different CPU, format or version. These examples are verification instructions, not results from an installer scan.

shasum -a 256 "photocraft-0.8.2-macos-universal.dmg"

sha256sum "photocraft-0.8.2-linux-x86_64.AppImage"

Get-FileHash -Algorithm SHA256 -LiteralPath ".\photocraft-0.8.2-windows-x64.msi"

Compare the complete hexadecimal hash with the line for that exact filename in SHA256SUMS.txt, ignoring letter case. Matching indicates that the local bytes match the published checksum; it does not detect every kind of malware, and a compromised source could replace both file and checksum. If the line is missing or the hash differs, do not open the file; recheck the release and source.

Treat signing claims and local verification separately

The README describes signed and notarized macOS builds, while the release documentation also explains that missing signing secrets can produce unsigned artifacts. Older source notes differ. We have not verified the signature of the selected binary, so this page makes no artifact-specific signing guarantee. Keep macOS / Windows protections enabled; review the publisher and platform warning rather than bypassing them. Signing is not a complete security audit.

Files and automation introduce separate risks

PhotoCraft’s Security Policy treats complex documents, image formats, paths and automation input as potentially malicious. It documents protection work and remaining gaps, including resource budgets and automation capability controls. Avoid untrusted files and unnecessary CLI / MCP exposure. A successful installation or a benign sample does not prove that hostile input is safe. Use copies and avoid sensitive production files during early-alpha trials.

When to stop and what to record

Stop when the source or version is uncertain, a checksum differs, a platform warning is unexplained or a document causes unexpected behaviour. Record the version, filename, hash and a minimal non-sensitive error summary. Consult the official Security Policy for reporting guidance; do not post credentials, private documents, weaponized samples or sensitive crash dumps publicly. This page does not claim that all current vulnerabilities have been checked.