Release Software Asset Distribution and Integrity

Sonja_Bauernfeind — Wed, 04 Jun 2025 06:28:38 GMT

Qlik distributes its release software assets through GitHub.

The assets are shared as releases in repositories under https://github.com/qlik-download.
https://github.com/qlik-download is part of Qlik’s enterprise account with GitHub

No external party can upload or modify content in the Qlik Download repositories. Access is controlled by Qlik’s corporate authentication.

The write access is exclusive to current Qlik employees and only to members of Qlik’s release management and security team.
The Qlik Community download page consists of an embedded Qlik Sense app.
The app is published through a Qlik Cloud tenant that is secured witgh Qlik’s corporate authentication.
Only a handful of Qlik employees are authorized to access the Qlik Cloud tenant.
No other employees or external parties can alter the information in the download app.

Qlik software is secured from malicious content as described in Secure SDLC Policy in https://security.qlik.com/.

Distributed installers are signed by Qlik, which the customer can validate in the file details after download. Any manipulation of the file content will invalidate the signature, and the OS will throw an error during installation.
Qlik software installer that is not signed by Qlik or displays any error should not be installed or trusted by customers.

article Release Software Asset Distribution and Integrity in Official Support Articles