Security
Published hosted files include a SHA-256 so you can verify the bytes you received.
Scanning and signature checks are part of the publish pipeline when enabled for the environment.
A clean scan is not a guarantee of software quality—always read the editorial notes and install with care.