Interesting, so this file was added using the gallery upload function, which accepts arbitrary files. And apparently the official releases are uploaded to the

Interesting, so this file was added using the gallery upload function, which accepts arbitrary files. And apparently the official releases are uploaded to the same URL directory? That's just asking for phishing. > Since this issue is closed, I suggest that you add your suggestion as a new issue I mean, I get it, but that sounds nonchalant for such a security issue; I'd expect the maintainer to open it themselves upon reading the problem. Although maybe that explains why the problem exists in the first place.