Audit seems to be checking the formula code not the source of the download? https://docs.brew.sh/Manpage https://docs.brew.sh/Manpage > Check formula for Home

Audit seems to be checking the formula code not the source of the download? https://docs.brew.sh/Manpage https://docs.brew.sh/Manpage > Check formula for Homebrew coding style violations. This should be run before submitting a new formula. Will exit with a non-zero status if any errors are found, which can be useful for implementing pre-commit hooks. If no formula are provided, all of them are checked. https://github.com/Homebrew/homebrew-cask/blob/master/USAGE.md https://github.com/Homebrew/homebrew-cask/blob/master/USAGE.... > audit — verifies installability of Casks You can see where it pulls from if you provide the --download flag but as far as I can understand it does not do any other validation regarding that. brew cask audit virtualbox --download AFAIK checksums are checked even if you don't run audit.