Releases you can verify
Binaries carry provenance, and vx upgrade checks every download’s SHA-256.
A task runner runs every command in your repo, so where its binary came from matters. vx release binaries carry build provenance, and the npm package is published with provenance.
vx upgrade checks the download against its SHA-256 before replacing anything.
More in Correct by default
A task sees only the env it names
Undeclared variables never reach a task, and secrets are masked in its output.
Projects stay in their lane
A project’s globs never reach into another project’s files.
Damaged artifacts are misses
Every artifact is checked before it is restored; damage means a rebuild, not a wrong file.
The sandbox says what to allow
A refused write is named beside the failed task, with the line that allows it.
Numbers mean what you typed
Hex, exponents and fractions are refused, never quietly reinterpreted.