Security

Verify Your Download

Ensure your installer has not been tampered with — takes 30 seconds.

Why verify? File verification confirms the installer came directly from VaultMorph and was not modified in transit or by a third-party site. Pick your product below.

Check a file online

SHA-256 hash checker

Select the release file you downloaded: Paste your file's SHA-256 hash:

SHA-256 checksums — v1.0.0

These checksums are published at release time and are also available in SHA256SUMS.txt in each GitHub release.

File	SHA-256
VaultMorph.AI.Shield_0.1.0_x64-setup.exe	00d85a2f61a8674ad73ed46439f03be001c5981e7cb575cd76a0eb4630c3708d
VaultMorph.AI.Shield_0.1.0_x64_en-US.msi	8655159637b02f546e773d7e62d6a507bb967b8b4650db35a627fcbed881a8ac
ai-shield-aarch64.dmg	— published at release —
ai-shield-x64.dmg	— published at release —
ai-shield-amd64.deb	— published at release —
ai-shield-x86_64.rpm	— published at release —

The authoritative SHA256SUMS.txt is attached to every release at github.com/NitinChauhan22/VaultMorph_AI_Shield_Chat_Public/releases.

Manual verification (command line)

If you prefer to verify locally without using the form above:

Windows (PowerShell)

Get-FileHash .\VaultMorph.AI.Shield_0.1.0_x64-setup.exe -Algorithm SHA256 | Select-Object Hash

Compare the output to the SHA-256 in the table above.

macOS / Linux

shasum -a 256 ai-shield-aarch64.dmg

Verify against the checksums file

# Download checksums file alongside the installer, then:
sha256sum --check SHA256SUMS.txt

Ed25519 signature verification

Each release is signed with our Ed25519 release key. The signature file (.sig) is published alongside each installer on GitHub Releases.

VaultMorph release signing public key

— Ed25519 public key published at first stable release —

This key is also pinned in the README.md at github.com/NitinChauhan22/VaultMorph_AI_Shield_Chat_Public. If the key shown here and the key in the README differ, do not trust either — contact contact@vaultmorph.org immediately.

Verify with minisign (recommended)

# Install minisign: https://jedisct1.github.io/minisign/
minisign -V -p vaultmorph-release.pub -m VaultMorph.AI.Shield_0.1.0_x64-setup.exe

Verify with openssl

openssl pkeyutl -verify \
  -pubin -inkey vaultmorph-release.pub \
  -sigfile VaultMorph.AI.Shield_0.1.0_x64-setup.exe.sig \
  -in VaultMorph.AI.Shield_0.1.0_x64-setup.exe

Trusted download sources

Only download VaultMorph AI Shield from these official sources. We do not distribute through any third-party app stores, torrent sites, or download portals.

vaultmorph.org — official website
github.com/NitinChauhan22/VaultMorph_AI_Shield_Chat_Public/releases — GitHub Releases

If you downloaded from anywhere else, delete the file and re-download from an official source.

Check a file online

SHA-256 hash checker

Select the release file you downloaded: Paste your file's SHA-256 hash:

SHA-256 checksums — v1.0.0

Also published in CHECKSUMS.md in the SecureGraph AI repository.

File	SHA-256
SecureGraph.AI_1.0.0_x64-setup.exe	85e0033706d0472ba03545fab31517eb39ef038b6bf3ac6c33b04c78afa3b16a
SecureGraph.AI_1.0.0_x64_en-US.msi	bcf38ce4460b378983bb8ef54bd954bd01f8bc963ec937d1ed5735f167858df6

Manual verification (command line)

If you prefer to verify locally without using the form above:

Windows (PowerShell)

Get-FileHash .\SecureGraph.AI_1.0.0_x64-setup.exe -Algorithm SHA256 | Select-Object Hash

Compare the output to the SHA-256 in the table above.

Windows (Command Prompt)

certutil -hashfile SecureGraph.AI_1.0.0_x64-setup.exe SHA256

Authenticode (code-signing) verification

Unlike AI Shield, SecureGraph AI is a Windows-only Tauri application and is signed with an Authenticode code-signing certificate rather than an Ed25519/minisign signature.

Note on trust: the certificate (CN=VaultMorph, thumbprint ED569AE15FE2290B01465695B0F09DE3EA8925BF) is currently self-signed — issued by VaultMorph, to VaultMorph — not by a public Certificate Authority. Windows will still show an "Unknown Publisher" warning on first run even on a genuine, unmodified installer. The signature below proves the file was not altered after VaultMorph signed it; it does not by itself vouch for VaultMorph as a publisher the way a CA-issued certificate would.

Verify the signature (PowerShell)

Get-AuthenticodeSignature .\SecureGraph.AI_1.0.0_x64-setup.exe | Format-List Status,StatusMessage,SignerCertificate

Expect SignerCertificate to show CN=VaultMorph with thumbprint ED569AE15FE2290B01465695B0F09DE3EA8925BF, and a timestamp from DigiCert (so the signature remains valid even after the certificate itself expires in 2031). A Status of UnknownError with "chain terminated in a root certificate which is not trusted" is expected for this self-signed certificate — that is not a sign of tampering, and is different from a missing or invalid signature.

Trusted download sources

Only download SecureGraph AI from these official sources. We do not distribute through any third-party app stores, torrent sites, or download portals.

vaultmorph.org — official website
github.com/NitinChauhan22/VaultMorph_SecureGraph_AI/releases — GitHub Releases

If you downloaded from anywhere else, delete the file and re-download from an official source.