Signed, and checked at every run
Each release carries an Ed25519 signature over its contents, verified against the
publisher's registered key. If a publisher is later revoked, templates already
installed stop running — the check happens at install and at run.
Sandboxed by default
A template runs in a subprocess with no Node API surface, capped at 30 seconds and
256 MB. Network, filesystem and environment access are granted per run, and only
where the template declared the need and you passed the flag.
Buy once, with the account you have
Paid templates cost a one-time price — no seats, no subscription. You authenticate
with your existing Forge key, so there is no second account to create.