One exact artifact
Every certificate names a single SHA-256 digest. Recompile the mod and the hash changes, so the old certificate no longer describes what you shipped, and the badge says so.
Proof that a Minecraft mod is what it claims to be.
Players have no way to tell a clean .jar from one carrying a token grabber. We read the bytecode, pin the build to a SHA-256 hash, and issue a certificate anyone can check in seconds.
- A named analyst reads every build
- Each certificate binds to one SHA-256
- Revocation is live, not cached
Check a certificate
Enter the number printed on the badge or scan its QR code.
Revoked and expired certificates are reported as such immediately. There is no cache to wait out.
Every certified build is read by a person
No certificate on this register was issued by a script. Automated analysis only decides what a reviewer looks at first. After that a named analyst opens the archive, reads the declaration and bytecode of every class it contains, inspects the strings and the external calls each one makes, and records what they examined before signing anything.
That record is kept. Every file an analyst opens during a review is written to an append-only audit log against their account, so the claim on this page is one we can evidence rather than one you have to take on trust.
What a certificate actually attests to
A badge is only worth something if the thing behind it is specific. Ours binds to one artifact, not to a project, a author, or a promise.
Bytecode actually read
A reviewer opens every class in the archive and reads what it declares, what it calls and what text is compiled into it. Automated analysis narrows where they look first; it never makes the decision.
Revocable the moment it turns
If a certified build is later found to be malicious, one revocation flips every badge in the wild to red. Badges are served from here, not baked into the publisher's page.
From upload to badge in five stages
Nothing is issued automatically. A named analyst signs off on every certificate this authority puts its mark on.
1
Submit the build
Upload the compiled .jar you intend to distribute, tagged with its version string.
2
Automated analysis
The archive is unpacked in isolation and every entry is checked against our indicator set.
3
Analyst review
A reviewer reads the findings, inspects flagged classes, and compares the build against its source.
4
Issue and publish
A certificate number, QR code and embeddable badge are generated and sealed against tampering.
5
Continuous monitoring
Certificates lapse after 365 days and can be revoked at any time on the strength of an abuse report, a new indicator, or a publisher's own request. Every badge fetch reflects the status at that instant.
The badge people can actually check
Drop one line of HTML onto your CurseForge description, Modrinth page or your own site. The badge image is served from this authority, so its state is always current. Every badge links back to a verification page carrying the build hash.
<a href="https://backprobe.org/verify/BP-4KX9-2PB7-QM3V">
<img src="https://backprobe.org/badge/BP-4KX9-2PB7-QM3V.svg"
alt="BackProbe certified" width="196" height="64">
</a>Shipping a mod people should trust?
Registration is free. You only pay when a build passes review and you want the certificate issued.