Is ArtCraft safe to install?
Short answer: the source is public and the licenses are permissive, but the builds are early and you should verify where they came from. Here is how to do that without guessing.
Last updated
What open source actually buys you
Open source is not a guarantee of safety, but it removes the main risk of closed software: you can read what the program does, and someone else can too.
ArtCraft publishes its apps on GitHub under permissive licenses. That means the code can be audited, forked and rebuilt by anyone, including people who do not trust the original author.
The limit is practical: most users will never read the source. The value is that a bad build would be visible to the people who do.
Verify the download
Download from getartcraft.com or the GitHub release pages it links to. The launcher is the recommended path because it installs and updates every app from the same source.
Avoid mirrors, repackaged installers and third-party download sites. An alpha build is exactly the kind of file that gets bundled with something else on those sites.
If a release publishes checksums, compare them. If it does not, prefer the launcher, which fetches from the project's own distribution.
What runs on your machine
ArtCraft describes its apps as native Rust builds for macOS, Windows and Linux, not Electron wrappers or web views. That is a smaller attack surface than a browser runtime, but it is still software you install.
If you care about network behaviour, run one app with a firewall rule that blocks outbound traffic and see what breaks. A local editor should keep working; a tool that needs the network will tell you quickly.
The exact evidence we can point to
The releases are published per version, for example github.com/storytold/photocraft/releases/tag/v0.20.2 for PhotoCraft and the matching tag for PdfCraft. Each release page lists every platform build and a SHA256SUMS.txt file.
The archives we inspected ship LICENSE-MIT, LICENSE-APACHE and a NOTICE file stating MIT or Apache-2.0, at your option. That is a permissive licence, but read the file in the repository for the version you install rather than trusting a summary.
Both command-line builds we downloaded matched their published SHA256 values. The check is one command: shasum -a 256 on the file, compared with the line in SHA256SUMS.txt.
How to verify a download in three minutes
The project publishes its source at github.com/storytold, with the apps under that organisation and the launcher at storytold/craft-launcher. Open the release you intend to install and confirm it was published by that organisation, not by a similarly named account.
Check the repository's LICENSE file rather than a summary. The site describes the licences as permissive, but permissive covers a family of licences with different conditions, and only the file in the repo is authoritative for the version you are running.
If a release publishes checksums, compare yours with the published value before you install. If it does not, the launcher is the safer route because it fetches from the project's own distribution rather than from a mirror.
One rule that catches most real incidents: if you cannot find the release on the project's own GitHub organisation, do not install it.
The real risk is alpha software
The most likely way ArtCraft hurts you is not malware, it is a crash during a save or a project file that changes between releases.
Do not open your only copy of a project in an alpha build. Work on duplicates, keep backups, and read the changelog before updating in the middle of a project.
For paid work, the safe pattern is: alpha for experiments, mature tools for delivery.
License and commercial use
The apps are published under permissive open-source licenses, which generally allow commercial use. Read the specific license of each app before you rely on it for client work.
Permissions have conditions, usually around attribution. A permissive license is not the same as public domain.
A five-minute safety checklist
1. Did the download come from getartcraft.com or GitHub releases? 2. Is the app you are installing one you actually need? 3. Have you tested it on a copy? 4. Do you have a backup of the original? 5. Would you be able to redo the work if the app crashed?
If any answer is no, stop and fix that before installing. The checklist catches more real incidents than any malware scan.
Questions
Is ArtCraft a virus?
The official builds are not. The risk is unofficial copies, so only trust the official download pages.
Is it safe to use for commercial work?
The licenses are permissive, but alpha stability is the bigger risk. Read the license and test before relying on it.
Does ArtCraft need an internet connection?
The apps are local desktop programs. Check each app for optional online features before assuming either way.
Should I install the launcher or single apps?
Install single apps if you need one job done. Use the launcher if you want to follow the whole suite.