release-mac-app

Likely benign release automation with official Apple/GitHub/Sparkle/1Password data flows and proportionate secret usage, but the core helper is a local unverifiable executable on a personal path. That supply-chain trust gap materially raises risk even without signs of malware or credential exfiltration.