Keep private signing keys, access tokens, game assets and personal workspaces out of issues and pull requests. Report sensitive findings privately to the maintainers; use GitHub private vulnerability reporting when enabled.

Update trust is pinned independently of the host. The client accepts only signed stable releases for duck-workshop, verifies signed size/SHA256 before installation, and validates HTTPS redirects. No private key or GitHub token is embedded. Replacing a public key requires a deliberate trust rollout; see RELEASING.md.

Private release keys stay outside source control. CI has read-only permissions and receives no signing keys. Release assets are covered by a detached RSA-PSS-SHA256 signature over SHA256SUMS.txt, in addition to the app's signed update manifest. See RELEASING.md for verification instructions.

The 2026-11-01 OSV audit of all 438 registry packages in the release Cargo.lock reported no matching security vulnerabilities and four informational maintenance notices. This is a point-in-time dependency check, not a claim that all application code or future dependency advisories have been covered.

The release updates zip to 9.0.5 for its published archive-reader fixes, including GHSA-m665-v7pm-7grj. It also updates rustls-webpki to 0.103.16 and webpki-roots to 1.0.10 for the distrusted-intermediate issues documented in RUSTSEC-2026-0382 and RUSTSEC-2026-0381. ZIP default features remain disabled; only Deflate support is enabled.

The remaining maintenance notices are:

• ttf-parser 0.25.1 (RUSTSEC-2026-0192), used by the Windows egui font stack.
• zbus_names 4.3.4 (RUSTSEC-2026-0371), zvariant 5.15.0 (RUSTSEC-2026-0370) and zvariant_derive 5.15.0 (RUSTSEC-2026-0372), present in the cross-platform lockfile but absent from the Windows normal/build dependency graph.

Track the upstream migrations without treating these maintenance notices as resolved. Recheck the complete locked dependency set before each release.