Currently, the link we get for checking the release folder in cases of forked repos is not the place where the tarball is uploaded. This is the location where the tarball is present and the link goes to here
Ok, werkzeug.secure_filename() is the culprit.
werkzeug.secure_filename()
Let's see if we can remove it though.
Ok, looks like we can, the regex used to validate the project name should be sufficient :)
Commit 01bcbc54 fixes this issue
@pingou changed the status to Fixed
Fixed