Found something that doesn't look right? Thank you for taking the time to report it. Please use GitHub's private vulnerability reporting rather than a public issue, so there's time for a fix before the details are out in the open.

Include whatever detail you can (steps to reproduce are gold). You'll get an acknowledgement within 7 days, and a fix or a plan within 90. Please hold off on public disclosure until a fix has shipped; every report is appreciated, even the false alarms.

Release artifacts are signed with keyless build provenance: there is no long-lived signing key, the signature is tied to the GitHub Actions workflow that produced it, and it's recorded in a public transparency log. To check a downloaded file:

gh attestation verify main.js --repo 8thpark/geode

Run it against each downloaded asset (main.js, manifest.json, styles.css). A pass proves the file is byte-identical to what this repository's automation signed, and unmodified since.

Each release also ships a per-asset signed provenance bundle (main.js.sigstore.json and so on), so you can verify against the shipped bundle rather than fetching the attestation from GitHub's API:

gh attestation verify main.js --bundle main.js.sigstore.json --repo 8thpark/geode

For releases from 0.1.0 onward the attestation is stronger: the artifacts are built from source in the release workflow, so the provenance ties them to the exact commit they came from. 0.1.0-beta.1 predates that pipeline and was signed retroactively over its already published bytes, so its attestation proves authenticity and integrity, not a build from source.