> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/unigetui/guides/understand/trust-and-security.md).

# Where packages come from and what to trust

Know who publishes the apps you install through UniGetUI, how to check a package before you install it, and how UniGetUI keeps itself safe.

UniGetUI installs software on your computer, often with administrator rights. That's powerful, so it's worth knowing who you're trusting at each step. In short: trust UniGetUI to pass your request along faithfully, trust the package manager to point to the right installer, and decide for yourself whether you trust the publisher.

## Who is responsible for what

<table><thead><tr><th width="200">WHO</th><th>WHAT YOU CAN EXPECT</th><th>WHAT THEY DON'T DO</th></tr></thead><tbody><tr><td><strong>Devolutions (UniGetUI)</strong></td><td>Signed releases, verified self-updates, security fixes, and settings that block risky features.</td><td>Host, review or vouch for the apps you install.</td></tr><tr><td><strong>Package managers</strong></td><td>A catalog of apps with the address of each installer and, for many of them, a hash to check it hasn't been altered. Some catalogs, like WinGet's, review new submissions.</td><td>Write the software or guarantee it's safe.</td></tr><tr><td><strong>Publishers</strong></td><td>The app itself, usually downloaded from their own servers.</td><td>Anything outside their app.</td></tr></tbody></table>

{% hint style="warning" %}
UniGetUI and the package manager maintainers can't vouch for every package. Only install software from publishers you trust.
{% endhint %}

## Check a package before you install it

When an app is new to you, take ten seconds to look at where it comes from.

1. Right-click the package and choose ***Package details***.
2. Check the ***Publisher*** and ***Homepage***. Do they match the company you expect?
3. Check the ***Package Manager*** (the source) and the ***Installer URL***. A download from the publisher's own domain is a good sign.
4. If anything looks off, don't install it. Search for the publisher's official name instead.

Fields that the package manager doesn't provide show ***Not available***. That's common for smaller catalogs and isn't a red flag by itself.

## Built-in safeguards

UniGetUI has a few protections that work without you doing anything, and a few you can tighten.

* **Installer hashes.** When the package manager provides a hash, the downloaded installer must match it. Only use ***Skip hash check*** or ***Skip integrity checks*** when you trust the source and know why the hash changed.
* **Minimum age for updates.** You can hold back brand-new releases for a few days, which keeps you away from a faulty or compromised version until others have tried it. See [Avoid brand-new releases](/unigetui/guides/updates/update-safely.md).
* **Installer host warning (WinGet).** UniGetUI warns you when a new version downloads from a completely different server than the one you have installed. See [Avoid brand-new releases](/unigetui/guides/updates/update-safely.md).
* **Dangerous settings are locked.** Custom command-line arguments, custom package manager executables, and commands imported from bundles are off by default. On Windows, changing them requires administrator approval. See [Lock down risky settings](/unigetui/for-it-teams/organization/restrict-settings.md).
* **Bundles are screened.** When a bundle contains content these settings block, UniGetUI shows a ***Bundle security report*** before importing it.

## How UniGetUI protects itself

* **Signed installer.** The Windows installer is digitally signed by Devolutions.
* **Verified self-updates.** Before installing a new version of itself, UniGetUI checks the file's hash against the one published with the release. On Windows it also checks the Devolutions signature, and on macOS the app signature. If a check fails, the update stops and UniGetUI shows ***The installer authenticity could not be verified.***
* **Integrity check at startup.** UniGetUI checks that its own files are present and unaltered. If one isn't, the ***Integrity violation*** dialog recommends reinstalling.

## Get UniGetUI from official sources only

{% hint style="danger" %}
Only download UniGetUI from [devolutions.net/unigetui](https://devolutions.net/unigetui/), the [official GitHub repository](https://github.com/Devolutions/UniGetUI/releases), or the [Microsoft Store](https://apps.microsoft.com/detail/xpfftq032ptphf). Websites with names like UniGetUI or WingetUI that aren't on this list aren't affiliated with Devolutions.
{% endhint %}

## Keep UniGetUI up to date

Security fixes only help if you install them. UniGetUI updates itself by default (***Update UniGetUI automatically*** in ***Settings*** – ***General preferences***), so leave that on.

Security issues found in UniGetUI are published, with their fixes, on the [Devolutions security advisories](https://devolutions.net/security/advisories/) page.

## Your data

UniGetUI can send anonymous usage data to help improve the app. It doesn't collect personal information. To review your choice, go to ***Settings*** – ***General preferences*** and click ***Manage telemetry settings***.

## Found a vulnerability?

Report it privately through the [Devolutions security page](https://devolutions.net/security/), not in a public GitHub issue.

## Next

* [Avoid brand-new releases](/unigetui/guides/updates/update-safely.md)
* [Lock down risky settings](/unigetui/for-it-teams/organization/restrict-settings.md)
* [Let users install approved apps without admin rights](/unigetui/for-it-teams/organization/devolutions-agent.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/unigetui/guides/understand/trust-and-security.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.