Verify identity
Check project ID, maintainer, file name, version, and game target against the version ledger. A file with the right name from an unrelated host has not inherited the project's trust.
Respect file boundaries
Java uses JAR files from the Java project. Bedrock uses MCADDON files from a chosen Bedrock project. An Android APK branded as Verity is a different application and should not be treated as the Minecraft add-on.
Protect worlds and secrets
Use a copied test world, avoid public reuploads, and never share Groq or other provider keys. Experimental Bedrock APIs and AI-backed mods add operational risk even when the source project is legitimate.