RedSync source is distributed under the GNU Affero General Public License v3.0. The source tree is the authoritative, inspectable form of the project. Prebuilt launchers and server packages are convenience artifacts, not a substitute for reviewing or building the source.

Release packages must be obtained over HTTPS and must publish a SHA-256 value in the matching channel manifest. The launcher verifies the complete archive hash before applying an update and refuses missing or mismatched hashes. A hash detects corruption or a stale package; it is not a digital signature.

Windows release signing is a separate operator-controlled step. Until an Authenticode certificate is configured and the signature is independently verified, treat a downloaded executable as untrusted and build it locally from source instead. The repository does not embed signing certificates, private keys, webhooks, panel tokens, VPS addresses, or deployment passwords.

The repository contains deployment-neutral examples only. Operators inject the CDN base URL, relay catalog, SSH host, SSH user, and tokens through environment or private deployment configuration. Local health probes may use loopback HTTP; remote download and update paths must use HTTPS.

release/docs/security-audit-2026-08-04.md is a historical read-only audit. Its VPS findings describe the state observed on that date and are not evidence that those changes were applied. The live host must be independently checked before any public deployment.

Do not open a public issue containing crash archives, IP addresses, access codes, webhook URLs, private keys, or server logs with player data. Send a minimal reproduction and sanitized logs to the project maintainers through a private channel. Crash reports are kept locally when no operator webhook or panel token is configured.

Before publishing a package, verify all of the following:

• python3 tools/security/check-public-surface.py passes.
• The package is complete and extracts cleanly.
• The channel manifest version matches the embedded client and launcher.
• The manifest SHA-256 matches the exact archive being served.
• The download endpoint is HTTPS and access controls are configured outside the repository.
• A signed Windows artifact is used for public distribution, or the release is clearly marked unsigned and users are directed to build from source.
• The live server has key-only administration, a default-deny firewall, restricted database/management ports, and TLS at every remote admin/download boundary.