What’s the Difference Between Verified and Unverified Flatpaks, and Is Oversteer Safe?

The important distinction is publisher identity, not necessarily whether the software is safe. Many legitimate applications are unverified because their original developers haven’t claimed the app ID or don’t maintain the Flatpak themselves. Even some well-known programs can be unverified for that reason.

Flatpaks also run with sandbox restrictions, although the effectiveness depends on the permissions they request. Before installing, look at those permissions and be cautious if an unrelated app asks for broad access to your entire home directory, hardware, or system files.

Think of verification like checking who is selling a product: it tells you the seller has proved their identity, but it doesn’t certify every aspect of the product. An unverified package may still be perfectly legitimate, especially when the upstream project points users toward it. For extra confidence, install only from the official Flathub listing, inspect the maintainer and update history, and avoid random download links or commands from unknown sources.

On Flathub, “verified” mainly means the developer has confirmed ownership of the app’s identity, usually with a token. It often indicates that the developer or an approved party publishes or maintains the package. “Unverified” usually means the Flatpak was submitted and is maintained by a community member or another third party.

That label is about identity and publisher verification, not a complete security guarantee. A verified app can still contain bugs, and an unverified app isn’t automatically malicious. It’s worth checking who maintains the package, whether the project recommends that installation method, how recently it was updated, and what permissions it requests.

Oversteer’s project documentation lists Flatpak as a supported way to install it, which is a positive sign. The unverified badge most likely means the Flatpak is community-maintained rather than published directly by the Oversteer developers. You should still review its permissions and compare the package with the project’s official documentation, but installing and then uninstalling it without changing permissions is unlikely to have caused any problem.