Swap the API address for GitHub's signed download address on upgrader_package_options, before any upgrader_pre_download filter runs. GPLVault Updater returns false there for every package at priority 999999999, which threw away the downloaded file and left WordPress fetching the API address without the token (404). private_download() stays as a fallback; both use signed_address().
For wpallstars/seoprostack#261
The parts every wpallstars plugin needs: settings screen with search and an empty General tab, Read Me tab, features as classes, replaced plugins, the shared GitHub updater, release and check scripts, CI and the shared rules. scripts/rename-plugin.sh starts a new plugin; scripts/sync-core.sh keeps plugins' core files in step with this starter. Built with aidevops (https://aidevops.sh).
marcus