Before release
Name primary and backup maintainers, open a private reporting channel, set patch deadlines, and test emergency rollback.
Security
One runtime. One clear responsibility.
Sharing a browser runtime is worthwhile only if updates become faster and easier to inspect. Security work belongs in public view, not in the footer.
With every package
Publish input hashes, the builder identity, SBOM, provenance, test results, and signed repository metadata.
When something breaks
Publish advisories separately from routine news and preserve the history even when a package must be pulled.