# Is armelgeek/blitzrecorder safe? Code check by OpenYard

Repository: https://github.com/armelgeek/blitzrecorder
Page: https://openyard.cloud/check/armelgeek/blitzrecorder

Verdict: No signs of malware or supply-chain tricks.
Checked 2026-11-10 at commit 7160bc3 by vetcode 0.3.1, reading 930 files without running anything.

What the code can do:
- None of the sensitive abilities checked: secrets, network, other programs, user and machine details, startup folders, code built at runtime.

Malware and supply-chain findings:
- medium: Checkout keeps the token on disk in a job that uploads artifacts (gha-persisted-credentials) at https://github.com/armelgeek/blitzrecorder/blob/7160bc3c7a2e2c4a61d5d6609186071167c79b15/.github/workflows/app-store-release.yml#L44
- medium: Checkout keeps the token on disk in a job that uploads artifacts (gha-persisted-credentials) at https://github.com/armelgeek/blitzrecorder/blob/7160bc3c7a2e2c4a61d5d6609186071167c79b15/.github/workflows/ci.yml#L27
- medium: Checkout keeps the token on disk in a job that uploads artifacts (gha-persisted-credentials) at https://github.com/armelgeek/blitzrecorder/blob/7160bc3c7a2e2c4a61d5d6609186071167c79b15/.github/workflows/ios-testflight.yml#L27
- medium: Checkout keeps the token on disk in a job that uploads artifacts (gha-persisted-credentials) at https://github.com/armelgeek/blitzrecorder/blob/7160bc3c7a2e2c4a61d5d6609186071167c79b15/.github/workflows/macos-dmg.yml#L34
- medium: Checkout keeps the token on disk in a job that uploads artifacts (gha-persisted-credentials) at https://github.com/armelgeek/blitzrecorder/blob/7160bc3c7a2e2c4a61d5d6609186071167c79b15/.github/workflows/resilience.yml#L48
- medium: Checkout keeps the token on disk in a job that uploads artifacts (gha-persisted-credentials) at https://github.com/armelgeek/blitzrecorder/blob/7160bc3c7a2e2c4a61d5d6609186071167c79b15/.github/workflows/windows-release.yml#L23

These are patterns, not proof. Vulnerability candidates and leaked-secret locations are not published.

To review it more deeply, install the vetcode skill in an AI coding agent (npx skills add openyard-cloud/vetcode) and ask it to review https://github.com/armelgeek/blitzrecorder.