Read the trust boundary.

Broken transport

Broken transport authentication on an executing update channel, without effective independent payload authentication.

TLS-only

Validated TLS authenticates distribution, without independently authenticating the update payload.

Publisher identity

The client enforces a valid payload code signature for the expected OS-recognized publisher identity.

Pinned signing key

The client enforces a payload signature against a public key already trusted by the application.

None / notify

The initial scan recorded no in-app updater or notification-only behavior. This is not a security rating.

What these counts mean

This collection contains 3,006 historical records, including duplicate projects and separate platforms and installation channels. The website displays the original Claude Code findings and tier assignments as the primary study results.

The sample was assembled for breadth, not randomly selected. Neither these counts nor agreement between AI reviewers establishes a population-wide security rate.

How the analysis worked

Claude Code agents inspected source in batches and recorded update behavior, transport, payload verification, and trust roots. A later automated verification pass was removed from the primary presentation after systematic failures to find code that was present in its own retained checkouts. That pass remains in repository history for auditability. The study author reports manually reviewing Tier D.

Important distinctions

A user-initiated update can still install code. A browser link is notification-only. Plugins, firmware, and application updates need separate scopes. HTTPS with proper validation protects transport; a checksum from the same compromised distribution service does not independently authenticate a release. Signature enforcement does not protect against every compromise of the build or authorized release process.