A security company that asks you to run its binaries owes you a way to check them. Uploads land in quarantine and are scanned; only the Founder can sign and publish, using an ed25519 key over the file’s SHA-256; and anything we revoke disappears from this page and reappears as a public incident notice. Nothing here is a build somebody dropped on a server.