Report security problems privately through GitHub's private reporting, not in a public issue. That covers the addon, the sidequest-sync uploader, and anything that could leak a sync token or let someone change another player's points.

Only the latest release gets fixes.

Every release zip is built by GitHub Actions from a signed tag. The same file goes to CurseForge and to GitHub releases, and GitHub releases can't be changed once published. To check that a zip came from this repo's release workflow, install the GitHub CLI and run:

gh attestation verify SideQuest-v0.2.0-forever.zip --repo SideQuest-Guild/addon

To check a zip against the GitHub release it came from:

gh release verify-asset v0.2.0 SideQuest-v0.2.0-forever.zip --repo SideQuest-Guild/addon

Each release also carries an SPDX SBOM (.spdx.json) listing every file in the zip with its SHA-256, and SHA256SUMS.txt.