Constant RECORD_HMAC_KEY 

const RECORD_HMAC_KEY: &[u8] = b"entracte/supporter-record/v1\0\
                                this-key-binds-supporter-records-against-text-editor-tampering";

Tag-binding HMAC key for supporter.json. The threat model here is “raise the bar above text-editor tampering” — a determined user with the binary can extract this constant, so this is not a security boundary against a sophisticated adversary. It is, however, sufficient to detect casual JSON edits (“flip is_supporter to true”) and prevents replay of records between machines (each install pins the HMAC against a per-record activated_at + instance_id).