d4not library is an index of links to external repositories. We don't host, serve, or own the code behind any entry. That means you are responsible for reviewing what you run. Here's everything we actually do to help you make that call — and where our responsibility ends.
@d4not personally cloned the repository, read the source, checked the dependencies, and signed off. Reviewer handle and date appear on the project page. During beta, @d4not is the only reviewer — response is manual and slow.
Aspirational. When live, repos get run through npm audit / pip-audit / cargo audit equivalents automatically. Today this badge is not assigned to anything — the scanner isn't wired up yet. Everything currently sits in "Reviewed" or "Unverified."
Default for every new submission. Treat it exactly like any public repo you found on the internet. Read the source before running anything.
During beta, these checks are manual and done by @d4not personally. Automation lands in Phase 2.
If you find malware, a backdoor, stolen code, or a license violation, email contact@d4notlibrary.com. During beta there's no SLA — response time depends on when @d4not sees the message. Confirmed bad actors are removed immediately and their submitter account is banned. A proper in-app report button + moderation queue lands in Phase 2.
A formal reviewer program — with community volunteers, application flow, and shared responsibilities — is planned for Phase 2, once the index has enough projects to make reviewer effort worthwhile. For now, @d4not is the only reviewer. If you're keen to help before then, email contact@d4notlibrary.com and we'll figure something out case by case.