Numbers mean what you typed
Hex, exponents and fractions are refused, never quietly reinterpreted.
--concurrency 0x10 or --timeout 1e3 might parse as something you did not mean. vx refuses them and says what a valid value looks like.
A mistyped flag gets the nearest real one, so --retries points you to --retry.
// what it prints
$ vx run build --timeout 1e3
vx run: --timeout must be a positive integer in ms (got 1e3)More in Correct by default
A task sees only the env it names
Undeclared variables never reach a task, and secrets are masked in its output.
Projects stay in their lane
A project’s globs never reach into another project’s files.
Damaged artifacts are misses
Every artifact is checked before it is restored; damage means a rebuild, not a wrong file.
The sandbox says what to allow
A refused write is named beside the failed task, with the line that allows it.
Releases you can verify
Binaries carry provenance, and vx upgrade checks every download’s SHA-256.