Publishing a closed source .dmg via github releases? Anonymously? What could possibly go wrong with that.

At least publish the sources, so people can compare it to the dmg contents.