Signify Creator v0.3.1

Security correction

This release replaces the v0.3.0 install artifact after identifying that the previous local packaging process recursively copied ignored runtime media from the working public directory. The affected custom v0.3.0 and release-candidate assets were removed; source archives and immutable tags were preserved.

Changes

• Package only an explicit allowlist of product-owned static banners and icons.
• Create clean data, backup, upload, and generated-banner runtime directories during builds.
• Add a mandatory release-artifact gate to the standard check pipeline.
• Reject tenant uploads, generated campaign media, databases, backups, logs, archives, dependency trees, local environment files, and populated provider secrets.
• Preserve the setup wizard, three-level RBAC, tenant isolation, M365 consent, owner-level Stripe controls, campaign overlays, signature rendering, and all existing product functionality.

Verification

• Formatting and ESLint passed.
• Setup and full smoke suites passed.
• Production build and artifact policy test passed.
• Clean production-only dependency install passed.
• npm audit reported 0 vulnerabilities.
• Archive inspection passed for all 71 entries.

Integrity

SHA-256: 759da6b3d3eafc280f49e38b52830630d70d4574de828bb4e8cacb041b8ec27e

Use Signify-Creator-v0.3.1.zip for Node.js deployment and verify it with the attached checksum file.