Security

What the installer and updater verify, and where secrets live.

Releases are signed. CI signs each channel's version-latest.properties and install.sh with an Ed25519 key. The public key is built into the program and into the published installer. The installer and bxcachy update verify the signature and the SHA-256 of every file they download; any mismatch stops before anything changes.
The first curl | bash trusts the script it downloads (TLS and the bucket). For a stricter first install, download install.sh and install.sh.sig and check the signature yourself with keys/release.pub.
Nothing runs without a plan. Commands that change the system print a plan and need --yes.
Your files are yours. BxCachy keeps a config you changed and only rewrites files it wrote; every write is atomic, backed up and journaled.
Secrets live in the desktop keyring (or a private file fallback), are typed hidden, and never appear in answers files, logs or shell history.
Skills from the hub are audited; one that failed its audit is refused.