Skip to main content

Download security review

Channel moderators can help uploaders start or retry required pipeline checks. Server security reviewers can additionally release a quarantined file after a documented human review.

Start or retry a check​

For a download in a channel where you can edit discussions:

  1. Open the download detail page.
  2. Select Pipelines.
  3. For a required check marked Not executed, select Run checks.
  4. For the latest failed, timed-out, or cancelled attempt, select Run checks again.
  5. Review the new attempt and its public diagnostics.

Only one attempt can be active for the same file version and pipeline. Retry cooldowns and limits protect providers from accidental retry storms.

Review quarantine safely​

Users with the server's permanent-removal permission can open the Download security review queue on the Admin Dashboard. The queue contains files with SUSPICIOUS, INFECTED, or FAILED scan states.

Before taking action:

  1. Open the download page and pipeline history.
  2. Read the scanner's public finding and remediation guidance.
  3. Check whether the creator requested review and read their explanation.
  4. Prefer Retry scan when the failure is transient or inconclusive.
  5. Ask the creator to replace the file when unsafe content is confirmed.

Do not download or execute a quarantined attachment as part of ordinary review. Public diagnostics are intended to provide the evidence needed for triage without handling the file directly.

Release quarantine​

Use Release quarantine only when independent evidence supports allowing the file. Enter a specific reason, such as the verification performed and why the scanner result is a false positive.

The release:

  • records the reviewer and reason;
  • marks the current file version clean;
  • clears the review request;
  • notifies the uploader;
  • preserves the original pipeline attempt and scanner finding.

Replacing the binary creates a new file version. The prior approval does not make the replacement downloadable; required checks run again.

Escalate repeated failures​

If scans repeatedly time out or fail:

  • share the pipeline attempt permalink with a server administrator;
  • include the public diagnostic code;
  • do not copy credentials or internal logs into public discussions;
  • check the server dashboard for queue age, timeouts, repeated failures, and retry storms.

Expired jobs are recovered by the pipeline watchdog and become Timed out, after which an eligible uploader or moderator can retry.