Registry URLs tell SpotiFLAC where to look for installable extensions. Sources can come from a terminal export, from a .env file, or be added here. You can remove any of them, including ones set outside the app.

A directory lists registries (not extensions directly) for you to review. Nothing here is bundled either — add a directory URL someone shared with you, then click Discover to probe each registry it lists for reachability before deciding whether to add it above.

A registry's sha256 checksum proves a package wasn't corrupted in transit — it says nothing about who published it. Trust a maintainer's public key here to verify their signed entries too; unsigned entries are exactly as trusted as they are today.