The commit history is a mirror of the real codebase, I wanted to show people that I've been working on this for a long time and that it's not vibe coded ai slop. In retrospect it seems that it was a mistake to do this.
Neverclick is digitally signed with Microsoft Trusted Signing (now known as Azure Artifact Signing). I had to send them my address and ID to get my identity verified so that I'd get approved for it.
Is there anything else I can do to put your mind at ease?