# Secure Application Deployment > Release checklist for Windows Forms apps: files that must not ship, nuget.config API tokens, MSIX AppContainer isolation, service packs and signed SBOMs. - **Product:** TX Text Control .NET for Windows Forms - **Section:** Documentation - **Kind:** Topic - **Path:** TX Text Control .NET for Windows Forms > Security > Secure Application Deployment - **1431 words** - **Web URL:** https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/deployment/ - **LLMs URL:** https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/deployment/llms.txt - **LLMs-Full URL:** https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/deployment/llms-full.txt --- Before a Windows Forms application with TX Text Control goes to its users, a few checks keep secrets out of the installer and known problems out of the components. Some come from the license agreement, which names files that must never ship; others come from how packages reach your build and how Windows can isolate an application. The checklist below names each point and why it matters; the [Deployment Guide](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/deployment/llms-full.txt) has the complete steps for installers, MSIX and build pipelines. ### The Checklist | Check | Why | Read | |---|---|---| | The installer contains only redistributable runtime files and your own files | The license agreement forbids shipping licensing credentials and the development license | [Ship Only the Runtime Files](#ship-only-the-runtime-files) | | No *nuget.config* with an API token is in source control, the build output or the installer | The token gives access to the Text Control Private NuGet Feed | [Keep Feed Credentials Out of Builds](#keep-feed-credentials-out-of-builds) | | Signing certificates and their passwords aren't part of the installation, unless every user may sign with them | Whoever has the key can sign in its owner's name | [Certificate and Private Key Handling](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/certificates/llms-full.txt) | | The application runs with the access it needs, for example in an MSIX AppContainer | An isolated application can't reach resources it wasn't granted | [Run the Application in an AppContainer](#run-the-application-in-an-appcontainer) | | The TX Text Control package is on the latest service pack | Service packs contain fixes | [Keep TX Text Control Current](#keep-tx-text-control-current) | | You know the components you ship | When a vulnerability becomes known, the list of components shows whether your application is affected | [Check the Components You Ship](#check-the-components-you-ship) | ### Ship Only the Runtime Files The license agreement lets you ship the runtime files that Text Control designates as redistributable and forbids giving your users licensing credentials, the license file or your *nuget.config*. The license is compiled into your assembly, so the installed application needs none of them. [Redistribution Overview](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/deployment/redistribution/llms-full.txt) lists the files an application ships, and [Keep Licensing Information Out of the Deployment](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/deployment/licensing/#keep-licensing-information-out-of-the-deployment) the files to check for before a release. ### Keep Feed Credentials Out of Builds The Text Control Private NuGet Feed authenticates each developer with an email address and an API token, and the personal *nuget.config* you download contains both: - **Keep *nuget.config* out of source control.** On a build server, store the email address, the API token and the feed URL as secrets of the CI/CD system and create *nuget.config* from them before the restore, as [Build Servers](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/installation/licensing/build-servers/llms-full.txt) describes. - **Check the build output and the installer** for *nuget.config* before you release them. - **Replace a leaked token.** If a token or a *nuget.config* was shared by mistake, delete the token under **Manage API tokens** in your Text Control account and create a new one. Tokens also expire, as [Text Control Private NuGet Feed](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/installation/nuget/sources/#text-control-private-nuget-feed) describes. Projects that use Text Control Offline Packages, the local package folder installed by the setup, need no credentials for the restore. [Configuring Package Sources](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/installation/nuget/sources/llms-full.txt) compares both sources. ### Run the Application in an AppContainer By default, a Windows Forms application has full access to the resources of the user, such as the camera, the microphone, the location and the user's data. Packaged with MSIX and set to partial trust, it runs in an AppContainer instead, where it's isolated and reaches only the capabilities its package requests. Enable only the capabilities your application needs. [Run the Application in an AppContainer](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/deployment/msix/#run-the-application-in-an-appcontainer) shows the steps. ### Keep TX Text Control Current A service pack brings a new version of `TXTextControl.TextControl.WinForms.SDK`, such as 34.0.5 for Service Pack 5, and your project keeps the version it references until you update it. `dotnet list package --outdated` lists the packages that have a newer version, and [Installing and Updating Packages](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/installation/nuget/install-update/#update-to-a-new-service-pack) shows the update. .NET Framework projects, which reference the assemblies of the setup, get a service pack when you install the latest full setup and rebuild, as [Install a Service Pack](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/installation/setup/#install-a-service-pack) describes. ### Check the Components You Ship Text Control provides signed software bills of materials (SBOMs) for its NuGet packages starting with version 34.0, `TXTextControl.TextControl.WinForms.SDK` included, as the blog article [Signed CycloneDX SBOMs for CRA Compliance Available for Text Control Products](https://www.textcontrol.com/blog/2026/05/08/signed-cyclonedx-sboms-for-cra-compliance-available-for-text-control-products/) announces: - **Format.** Each SBOM is a JSON file in the [CycloneDX](https://cyclonedx.org/) format, *.cyclonedx.json*, with a detached PKCS#7 signature, *.cyclonedx.json.p7s*, that shows whether it is authentic and unchanged. - **Content.** It lists the package and its version, its supplier, its first-party and third-party dependencies including transitive ones, the third-party native libraries it contains, licensing metadata and a dependency graph. - **Availability.** Customers with an active subscription request the SBOMs of their licensed products from the Text Control support or sales team. Tools that read CycloneDX check the listed components against vulnerability databases. For the other packages of your project, the .NET SDK lists those with known vulnerabilities, including the packages they bring in: ```bash dotnet list package --vulnerable --include-transitive ``` The vulnerability data comes from package sources that provide it, such as nuget.org. Microsoft describes the options in [Auditing package dependencies for security vulnerabilities](https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages). ### Next Steps - [Deployment Guide](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/deployment/llms-full.txt): installers, MSIX, the runtime files and build pipelines. - [Application Licensing](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/deployment/licensing/llms-full.txt): the license in the deployed application. - [CI/CD](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/deployment/ci-cd/llms-full.txt): build and package the application on a build server. - [Security Overview](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/overview/llms-full.txt): how the parts of an application fit into its security. --- ## Nearby - **Previous:** [Certificate and Private Key Handling](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/security/certificates/llms-full.txt) - **Next:** [Performance](https://docs.textcontrol.com/tx-text-control-dotnet-winforms/performance/llms-full.txt)