One exact file
Every certificate names a single SHA-256 digest. Rebuild the mod and that digest changes, so the old certificate no longer describes what you are shipping, and the verification page says so.
Proof that a Minecraft mod is what it claims to be.
A compiled .jar tells a player nothing about what it will do once it loads. We read what is inside one and issue a certificate tied to that exact file's SHA-256, so anyone can check it.
Check a certificate
Enter the number printed on the badge or scan its QR code.
Revoked and expired certificates are reported as such immediately. There is no cache to wait out.
Every certified build is read by a person
Automated analysis only decides what gets looked at first. After that someone opens the archive, reads the declaration and bytecode of each class it contains, and looks at the strings and external calls before anything is signed. Every file opened during a review is written to an append-only log against the account that opened it.
What a certificate binds to
A badge is only useful if the thing behind it is narrow enough to check. Ours covers one artifact.
Revocable once issued
If a certified build later turns out to be malicious, one revocation is enough. The badge image is fetched from us every time a page loads it, so the change reaches everywhere it is displayed.
Getting there takes five stages, from upload through automated analysis to a human read and issue. All of them are written up on the review process page, including what gets a build turned down. Certificates lapse after 365 days.
The badge people can actually check
Drop one line of HTML onto your CurseForge description, Modrinth page or your own site. The image is served from this authority, so its state is always current, and it links back to a verification page carrying the build hash.
<a href="https://backprobe.org/verify/BP-4KX9-2PB7-QM3V">
<img src="https://backprobe.org/badge/BP-4KX9-2PB7-QM3V.svg"
alt="BackProbe certified" width="196" height="64">
</a>Get a build certified
Registration is free and submitting a build costs nothing. You are charged when a certificate is issued, and open-source projects are not charged at all.