Every package ships with a matching .sha256 file; verify the hash after downloading. Reference values for v2.0.0:
Windows installer
25e84f98ad5bd4095a15229930e6c3e43b9ad51ae44e71fd34422ab985fc3f3b
Windows portable
105c3e4ad7391b867854aa0168c2f4170c45de9a30d53ad84a15e3e577ca6531
macOS portable
81b6ebc7296746f061c3ac3c77bae3ebbc199af31a49f6b672352275c0c36204
macOS installer
0b5daedfbceb459823ab8ec12dd48bbd9774716aa7cf8c1dc22097c5b434a8f8
macOS installer (Apple Silicon)
9fc1806ad38f034cec4f01efc78bcc4ab2be7ac2b574c1e9e0c9d6bdca523f58
To verify (three steps): ① download the package and its .sha256 file; ② in that folder run Get-FileHash .\ResumeForge-2.0.0-windows.zip (Windows PowerShell) or shasum -a 256 ResumeForge-2.0.0-macos.zip (macOS / Linux terminal); ③ compare the output character by character with the value above before running it. In-app updates perform the same check before installing.