mirror of
https://github.com/storytold/craft-libs.git
synced 2026-11-09 12:04:09 +00:00
`Release`'s fields are public, so an app that builds one from its own feed or cache could hand any URL to the prompt's "What's new" link and to Action::OpenUrl after Download. Both now go through `release::safe_web_link`, as the launcher does before every open_url. `Http::with_github_token` says that ureq's debug logs print the Bearer token, so apps should redact it or keep ureq below Debug. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>