If you discover a security vulnerability in Transitrix Studio, please report it privately by emailing security@transitrix.com with:

• A description of the vulnerability
• Steps to reproduce it (if possible)
• The affected versions
• Any suggested mitigation or fix

Do not open a public GitHub issue for security vulnerabilities. We will acknowledge receipt within 48 hours and provide a timeline for resolution.

Security fixes are provided only for the latest stable release.

Earlier versions do not receive security fixes. We recommend upgrading to the latest stable release.

This support policy defines which versions will receive future security fixes. It does not, by itself, indicate that earlier versions contain known vulnerabilities or malicious code.

The release history identifies published versions and their verification materials. Release availability does not by itself establish a security-support commitment for a version branch.

The 3.2.0 audit finding covers the four packages distributed through Open VSX. It records file-origin and dependency checks, scan results, and a Windows x64 rebuild whose 519 extracted files matched by content hash. The original Microsoft-served packages were unavailable; byte-for-byte identity with those packages was not independently verified.

Microsoft Defender reported no threats in the examined 3.2.0 packages. VirusTotal recorded zero malicious and zero suspicious results, with some engines unable to complete analysis. These point-in-time results do not guarantee safety and are not scan results for later releases, including 3.8.1.

Release 3.8.1 provides the VSIX, SHA-256 checksums, a CycloneDX software bill of materials (sbom.xml), and build-provenance verification instructions. Consult each release's notes and assets for the evidence available for that specific version.

To verify the downloaded 3.8.1 VSIX's build provenance:

gh attestation verify --owner transitrix transitrix-studio-3.8.1.vsix

Review the verification output for the artifact digest, source repository and build workflow. Provenance associates an artifact with its recorded build; it is not a malware scan or a guarantee of safety. Checksums establish file integrity against the published values, and the SBOM supports component review.

Review the published evidence against your organisation's requirements and keep security protections enabled.

For non-security questions about Transitrix Studio, please open an issue on GitHub or visit transitrix.com.