diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index ca2e98c2b90..e5aa94061e1 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "hyperframes",
   "description": "HyperFrames by HeyGen. Write HTML, render video. Compositions, GSAP and runtime adapter animations, captions, voiceovers, audio-reactive visuals, and website capture for HyperFrames.",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "author": {
     "name": "HeyGen",
     "email": "hyperframes@heygen.com",
diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
index 93a1c3880b9..1580b8002e4 100644
--- a/.codex-plugin/plugin.json
+++ b/.codex-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "hyperframes",
   "description": "Write HTML, render video. Compositions, Tailwind v4 styles, GSAP and runtime adapter animations, captions, voiceovers, audio-reactive visuals, and website capture for HyperFrames.",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "author": {
     "name": "HeyGen",
     "email": "hyperframes@heygen.com",
diff --git a/.cursor-plugin/plugin.json b/.cursor-plugin/plugin.json
index a64a6e35e8a..726793f6b51 100644
--- a/.cursor-plugin/plugin.json
+++ b/.cursor-plugin/plugin.json
@@ -3,7 +3,7 @@
   "name": "hyperframes",
   "displayName": "HyperFrames by HeyGen",
   "description": "Write HTML, render video. Compositions, Tailwind v4 styles, GSAP and runtime adapter animations, captions, voiceovers, audio-reactive visuals, and website capture for HyperFrames.",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "author": {
     "name": "HeyGen",
     "email": "hyperframes@heygen.com"
diff --git a/docs/changelog.mdx b/docs/changelog.mdx
index 36a50eae784..6a37600d0b4 100644
--- a/docs/changelog.mdx
+++ b/docs/changelog.mdx
@@ -8,6 +8,32 @@ Recent HyperFrames releases, including user-facing features, fixes, and migratio
 
 {/* New release entries are prepended by `bun run changelog:draft <version> --write`. */}
 
+<Update
+  label="HyperFrames v0.9.35"
+  description="Released - 2026-11-11"
+  tags={["Release", "Security", "Share", "CLI", "Studio App"]}
+>
+Private files like `.env` and git data stay out of preview bundles, and local sharing only answers your own machine. Sharing also keeps tracking changes when `.hyperframesignore` uses gitignore patterns.
+
+## Fixes
+
+- **Security:** Preview bundles never include `.env` files or git data, even through a link. A render that names one of these files now stops with an error. Local sharing only answers this machine, so sharing from Studio in a container now gets a 403 ([a243169f8](https://github.com/heygen-com/hyperframes/commit/a243169f8a10fa26fe9e9d1d1623d68445e2a3c7), [#7563](https://github.com/heygen-com/hyperframes/pull/7563)).
+- **Security:** Helper programs are found by walking your trusted `PATH` folders directly. On Windows, the working folder is never searched ([9a048ac01](https://github.com/heygen-com/hyperframes/commit/9a048ac019e919f9e9c37b1b764172676434511e), [#7562](https://github.com/heygen-com/hyperframes/pull/7562)).
+- **Share:** Change detection keeps working when `.hyperframesignore` uses gitignore patterns such as `/exports/` or `**/*.mov`. Before, those patterns stopped it with an error ([c07468d6a](https://github.com/heygen-com/hyperframes/commit/c07468d6a7155d28828eef1058896b7aa74114a1), [#7568](https://github.com/heygen-com/hyperframes/pull/7568)).
+- **CLI:** Durations and sizes roll over to the next unit when rounded, so you see `1m 0.0s` and `1.0 MB`, not `60.0s` and `1024.0 KB` ([182608311](https://github.com/heygen-com/hyperframes/commit/182608311ad9781669b26288a944cc85f28ab1cd), [#7565](https://github.com/heygen-com/hyperframes/pull/7565)).
+
+## Docs & Examples
+
+- **Studio App:** The brand kits page says kits are shared with your workspace only ([c218b37a3](https://github.com/heygen-com/hyperframes/commit/c218b37a319661280f337a3304bb7a4f566bddf5), [#7570](https://github.com/heygen-com/hyperframes/pull/7570)).
+
+## Internal
+
+- **Core:** The preview runtime offers its parent a typed message port. This prepares Studio for a sealed preview frame and changes nothing yet ([ef5cdeb0a](https://github.com/heygen-com/hyperframes/commit/ef5cdeb0a02afc993980809cc359dd68a1c4944d), [#7556](https://github.com/heygen-com/hyperframes/pull/7556)).
+- **CLI:** Local Studio's share window counts button clicks and choices. Only fixed categories are recorded, never links, paths or email addresses ([2a70733c1](https://github.com/heygen-com/hyperframes/commit/2a70733c15798430e1fae817bc65f1bf90acbed6), [#7566](https://github.com/heygen-com/hyperframes/pull/7566)).
+
+[View the full commit range](https://github.com/heygen-com/hyperframes/compare/v0.9.34...v0.9.35).
+</Update>
+
 <Update
   label="HyperFrames v0.9.34"
   description="Released - 2026-11-11"
diff --git a/gemini-extension.json b/gemini-extension.json
index fc458db20bd..24412013292 100644
--- a/gemini-extension.json
+++ b/gemini-extension.json
@@ -1,5 +1,5 @@
 {
   "name": "hyperframes",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "HyperFrames by HeyGen. Write HTML, render video. Compositions, GSAP and runtime adapter animations, captions, voiceovers, audio-reactive visuals, and website capture for HyperFrames."
 }
diff --git a/packages/aws-lambda/package.json b/packages/aws-lambda/package.json
index 5850e0c0688..5ca80e39f15 100644
--- a/packages/aws-lambda/package.json
+++ b/packages/aws-lambda/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/aws-lambda",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "AWS Lambda adapter for HyperFrames distributed rendering — handler, client-side SDK, and CDK construct.",
   "repository": {
     "type": "git",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 25d37105ad8..b8c438a71e1 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/cli",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Make videos with code and AI agents: write HTML, render MP4. Open source.",
   "keywords": [
     "ai-agents",
diff --git a/packages/core/package.json b/packages/core/package.json
index 7a465a1a8ba..d72bed366ff 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/core",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "",
   "repository": {
     "type": "git",
diff --git a/packages/engine/package.json b/packages/engine/package.json
index 4a18aa4c405..1856e67f8cf 100644
--- a/packages/engine/package.json
+++ b/packages/engine/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/engine",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Seekable web page to video rendering engine (Puppeteer + FFmpeg)",
   "repository": {
     "type": "git",
diff --git a/packages/gcp-cloud-run/package.json b/packages/gcp-cloud-run/package.json
index 370717c6e9e..bc9ac2dfc22 100644
--- a/packages/gcp-cloud-run/package.json
+++ b/packages/gcp-cloud-run/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/gcp-cloud-run",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Google Cloud Run + Workflows adapter for HyperFrames distributed rendering — request handler, client-side SDK, and Terraform module.",
   "repository": {
     "type": "git",
diff --git a/packages/inspector/package.json b/packages/inspector/package.json
index b832020db5f..c3148da8c3c 100644
--- a/packages/inspector/package.json
+++ b/packages/inspector/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/inspector",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "repository": {
     "type": "git",
     "url": "https://github.com/heygen-com/hyperframes",
diff --git a/packages/lint/package.json b/packages/lint/package.json
index 9a7e0e1ea50..ffd9b2f6113 100644
--- a/packages/lint/package.json
+++ b/packages/lint/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/lint",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "repository": {
     "type": "git",
     "url": "https://github.com/heygen-com/hyperframes",
diff --git a/packages/parsers/package.json b/packages/parsers/package.json
index d85e3ad96e1..6db425f9a02 100644
--- a/packages/parsers/package.json
+++ b/packages/parsers/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/parsers",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "repository": {
     "type": "git",
     "url": "https://github.com/heygen-com/hyperframes",
diff --git a/packages/player/package.json b/packages/player/package.json
index 1e29f272199..945330f64db 100644
--- a/packages/player/package.json
+++ b/packages/player/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/player",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Embeddable web component for HyperFrames compositions",
   "repository": {
     "type": "git",
diff --git a/packages/producer/package.json b/packages/producer/package.json
index a484c032f38..817652788e2 100644
--- a/packages/producer/package.json
+++ b/packages/producer/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/producer",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "HTML-to-video rendering engine using Chrome's BeginFrame API",
   "repository": {
     "type": "git",
diff --git a/packages/sdk/package.json b/packages/sdk/package.json
index 548a3861acc..3142f9a8ead 100644
--- a/packages/sdk/package.json
+++ b/packages/sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/sdk",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Headless, framework-neutral HyperFrames composition editing engine",
   "repository": {
     "type": "git",
diff --git a/packages/shader-transitions/package.json b/packages/shader-transitions/package.json
index 6d3fd953e93..68cb2f5049f 100644
--- a/packages/shader-transitions/package.json
+++ b/packages/shader-transitions/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/shader-transitions",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "WebGL shader transitions for HyperFrames compositions",
   "repository": {
     "type": "git",
diff --git a/packages/share/package.json b/packages/share/package.json
index cabc601bdeb..998f0a1627e 100644
--- a/packages/share/package.json
+++ b/packages/share/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/share",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "Shared review identity, version upload and sharing state for HyperFrames hosts",
   "license": "Apache-2.0",
   "repository": {
diff --git a/packages/studio-server/package.json b/packages/studio-server/package.json
index 93fb567843f..c831656b735 100644
--- a/packages/studio-server/package.json
+++ b/packages/studio-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/studio-server",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "repository": {
     "type": "git",
     "url": "https://github.com/heygen-com/hyperframes",
diff --git a/packages/studio/package.json b/packages/studio/package.json
index ac8961652ea..578d3a9eb03 100644
--- a/packages/studio/package.json
+++ b/packages/studio/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hyperframes/studio",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "description": "",
   "repository": {
     "type": "git",
diff --git a/plugin.json b/plugin.json
index 1fa26c3ecf4..04e883545d5 100644
--- a/plugin.json
+++ b/plugin.json
@@ -2,7 +2,7 @@
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "hyperframes",
   "description": "HyperFrames by HeyGen. Write HTML, render video. Compositions, GSAP and runtime adapter animations, captions, voiceovers, audio-reactive visuals, and website capture for HyperFrames.",
-  "version": "0.9.34",
+  "version": "0.9.35",
   "author": {
     "name": "HeyGen",
     "email": "hyperframes@heygen.com",
diff --git a/releases/v0.9.35.md b/releases/v0.9.35.md
new file mode 100644
index 00000000000..8600018f8b6
--- /dev/null
+++ b/releases/v0.9.35.md
@@ -0,0 +1,25 @@
+# HyperFrames v0.9.35
+
+Released on 2026-11-11.
+
+Private files like `.env` and git data stay out of preview bundles, and local sharing only answers your own machine. Sharing also keeps tracking changes when `.hyperframesignore` uses gitignore patterns.
+
+## Fixes
+
+- **Security:** Preview bundles never include `.env` files or git data, even through a link. A render that names one of these files now stops with an error. Local sharing only answers this machine, so sharing from Studio in a container now gets a 403 ([a243169f8](https://github.com/heygen-com/hyperframes/commit/a243169f8a10fa26fe9e9d1d1623d68445e2a3c7), [#7563](https://github.com/heygen-com/hyperframes/pull/7563)).
+- **Security:** Helper programs are found by walking your trusted `PATH` folders directly. On Windows, the working folder is never searched ([9a048ac01](https://github.com/heygen-com/hyperframes/commit/9a048ac019e919f9e9c37b1b764172676434511e), [#7562](https://github.com/heygen-com/hyperframes/pull/7562)).
+- **Share:** Change detection keeps working when `.hyperframesignore` uses gitignore patterns such as `/exports/` or `**/*.mov`. Before, those patterns stopped it with an error ([c07468d6a](https://github.com/heygen-com/hyperframes/commit/c07468d6a7155d28828eef1058896b7aa74114a1), [#7568](https://github.com/heygen-com/hyperframes/pull/7568)).
+- **CLI:** Durations and sizes roll over to the next unit when rounded, so you see `1m 0.0s` and `1.0 MB`, not `60.0s` and `1024.0 KB` ([182608311](https://github.com/heygen-com/hyperframes/commit/182608311ad9781669b26288a944cc85f28ab1cd), [#7565](https://github.com/heygen-com/hyperframes/pull/7565)).
+
+## Docs & Examples
+
+- **Studio App:** The brand kits page says kits are shared with your workspace only ([c218b37a3](https://github.com/heygen-com/hyperframes/commit/c218b37a319661280f337a3304bb7a4f566bddf5), [#7570](https://github.com/heygen-com/hyperframes/pull/7570)).
+
+## Internal
+
+- **Core:** The preview runtime offers its parent a typed message port. This prepares Studio for a sealed preview frame and changes nothing yet ([ef5cdeb0a](https://github.com/heygen-com/hyperframes/commit/ef5cdeb0a02afc993980809cc359dd68a1c4944d), [#7556](https://github.com/heygen-com/hyperframes/pull/7556)).
+- **CLI:** Local Studio's share window counts button clicks and choices. Only fixed categories are recorded, never links, paths or email addresses ([2a70733c1](https://github.com/heygen-com/hyperframes/commit/2a70733c15798430e1fae817bc65f1bf90acbed6), [#7566](https://github.com/heygen-com/hyperframes/pull/7566)).
+
+## Full changelog
+
+https://github.com/heygen-com/hyperframes/compare/v0.9.34...v0.9.35