Features
Releases you can verify.
Trust in a desktop app should not rest on the developer's word. Mouzi publishes its source, release workflows and tagged release files for inspection.
Built in public CI
Public releases are compiled by GitHub Actions from tagged commits. The workflow files are part of the repository, so the build steps are open for inspection.
SignPath Foundation
Code signing approval in progress with SignPath Foundation. Once the production certificate is active, CI will submit release files under a restricted policy and verify their Authenticode signatures before publication.
Direct GitHub artifacts
The download buttons on mouzi.cc point to the files published on the official GitHub release rather than to a separate mirror.
Local verification
You can inspect an Authenticode signature when one is present and calculate a SHA-256 hash locally. A hash needs a trusted comparison value to verify a download.
Why a file organizer cares this much
Mouzi asks to watch your Downloads folder, where browsers place files before you open them. That makes the release path worth inspecting. Public workflows show how release artifacts are built, and mouzi.cc links directly to the files published on GitHub instead of maintaining a separate binary mirror.
Reporting vulnerabilities
Please report security issues privately through GitHub security advisories rather than public issues. Scope and response expectations are described in the security documentation.