---

name: oss-release-checklist description: Comprehensive checklist for releasing OSS projects. Covers security (CSP, PII, secrets), legal compliance (licenses, API terms, trademarks), privacy (GDPR, telemetry opt-out), and documentation. Use when preparing to open source a project, adding telemetry/error monitoring, auditing dependencies, or creating privacy policies.

OSS Release Checklist

Everything to verify before making a project public.

Quick Reference

Pre-Release Checklist

Security (Critical)

• CSP is not null in tauri.conf.json
• sendDefaultPii is NOT true in Sentry
• Sentry beforeSend scrubs sensitive data
• API keys/DSNs injected via CI, not hardcoded
• Event listeners have corresponding cleanup

Legal (Critical)

• API terms of service reviewed (caching, commercial use)
• cargo deny check passes (no GPL contamination)
• pnpm licenses:check passes (npm dependencies)
• LICENSE file present and matches package.json

Privacy (High)

• PRIVACY.md exists
• All third-party services documented
• Telemetry opt-out available in Settings
• "Takes effect after restart" noted where applicable

Documentation

• SECURITY.md network destinations accurate
• PRIVACY.md matches implementation
• README setup instructions current

Risk Matrix

Common Mistakes by Framework

Tauri

Error Monitoring (Sentry)

Dependencies

Audit Commands

Copy# Rust licenses
cargo deny check

# npm licenses
pnpm licenses:check

# Find hardcoded secrets
grep -r "sk-" --include="*.rs" --include="*.ts" .
grep -r "dsn.*sentry" --include="*.rs" --include="*.ts" .

For Forks

When someone forks your OSS:

1. Secrets should be empty (CI-injected)
2. Sentry disabled by default (no DSN)
3. Clear instructions for their own setup