What the record says
Opaque credential and dotenv-comment regressions plus adversarial archive fixtures fail closed. The exact current production release and a separately bound preview passed negative credential-path and package-content checks.
Source
Public destination, exact deployed source and owning release checks
Inspect the source record. GitHub access may be required for repository links.
Where the proof stops
This is actual release-path and artifact coverage, not a guarantee against every secret format or proof that a new creator has completed onboarding. Private account state and migration work remain separate.
Related project: App Composer.