A signed installer. Vex-0.2.5-win-x64.exe is signed as VEX LABS PTE. LTD. through Azure Trusted Signing, with an RFC3161 timestamp so the signature stays valid long after the short lived signing certificate rotates. Windows shows a named publisher instead of Unknown publisher.

Updates check their author before they install. From this version on, VEX on Windows updates itself. Before an update is applied, the downloaded installer's signature must be attributed to VEX LABS PTE. LTD. exactly, or it is refused. This pairing gets its first real world exercise with the next release.

Every binary is verified before it ships. The release pipeline fails closed unless the installer and every executable inside it are signed, timestamped, and attributed correctly. An unsigned Windows build cannot be published, the same way an un notarized macOS build cannot.

What signing does not buy. SmartScreen reputation attaches to the certificate identity and starts at zero, so early downloads may still see a warning until reputation accrues. That is expected, and it fades. And a self custodial wallet is antivirus bait: signing sharply reduces false positives, it does not eliminate them.

Off by default, and there is no default. The reporter only wakes if a service endpoint is configured, and this release configures none. Until a public AgentScan domain is announced, nothing is sent anywhere.

Privacy by construction, not by filter. A report event is built only from named, allowlisted fields, and excluded columns are never read: there is no line of code that touches them. Registration uses a random identity generated on your machine. Values that fail validation are sent as null rather than silently repaired.

Once, and only once. Reporting diffs the activity feed against a permanent report log, so an event can be reported exactly once, and the money path code gained zero hooks. Server verdicts are honored: quarantine or revocation stops the lane permanently, and only transient failures retry.