Reduce release package false positives

docs/release-readme.md

@@ -0,0 +1,34 @@
+# Ehwrj Portable Build
+
+Ehwrj is a clean-room War Thunder live map companion for Windows.
+
+This release package contains only the rebuilt benign application and its runtime files. It does not include the original analyzed sample.
+
+## Run
+
+1. Start War Thunder.
+2. Confirm the local map is available at `http://127.0.0.1:8111/map_info.json`.
+3. Run `Ehwrj.exe`.
+4. Use the main window to enable or disable the overlay.
+
+## Network Scope
+
+- Ehwrj reads War Thunder's local loopback API at `127.0.0.1:8111`.
+- Ehwrj does not contact external hosts.
+- Ehwrj does not read unrelated user files.
+
+## Settings
+
+Settings are saved under:
+
+```text
+%LOCALAPPDATA%\Ehwrj\settings.json
+```
+
+## Files
+
+- `Ehwrj.exe`: Windows application launcher
+- `Ehwrj.dll`: application code
+- `Ehwrj.Core.dll`: local API parsing and projection logic
+- `*.dll`, `*.json`: .NET, Avalonia, and native runtime dependencies
+- `SHA256SUMS.txt`: package file checksums

docs/release-security.md

@@ -0,0 +1,10 @@
+# Security Notes
+
+Ehwrj is a local War Thunder map companion.
+
+- Network access is limited to the local War Thunder API on loopback.
+- Settings are saved under the current user's local application data folder.
+- The overlay uses standard Windows window styles so mouse input can pass through it.
+- The release package contains the rebuilt application and runtime dependencies only.
+
+Report unexpected behavior with the exact release file hash and reproduction steps.