← Back

Build transparency

Confirm that the app you're using was built from our public source by an auditable, signed pipeline — not just a claimed commit hash.

Version
0.1.0
Source commit
bf0b8ba8b174
Image
694992586161.dkr.ecr.eu-west-1.amazonaws.com/dmtrading-app@sha256:b9658bd761be5167db9f921c7523de212172e73f0611832bd51b50e4f6bc9ca4
Built at
2026-10-31T14:25:46Z

Verify it yourself

With the GitHub CLI, this checks the signed provenance attestation binding the running image to the commit and workflow that produced it: 

{@build.verify_command}

Front-end bundle fingerprints

The digested filenames embed each bundle's content hash — your browser downloads exactly these, so the front-end is verifiable end to end.

assets/css/app.css
assets/css/app-842ff915d77a8934fe284189f02e2028.css
assets/js/app.js
assets/js/app-d5ca020fd1ccb6ec8f9d8689d6c61428.js

What this does and doesn't prove

  • Verifiable: the container image was built by our GitHub Actions workflow from the commit above, and the front-end bundles your browser loads match that source.
  • Not proven here: exactly what the server process is executing. Proving that to a remote party requires trusted-hardware attestation; today it rests on this provenance chain plus operational trust.

Looking for plain-language answers about your funds and safety? See how it works & your safety.