Quick answer: Godot 4 encrypted PCK leaving .translation files unencrypted? Translation format bypasses standard PCK encryption - convert to .csv at build time or compile into the binary.
Decrypted PCK; .translation files visible plaintext.
Compile translations
Use binary translation format (.translation) but ensure the build-time format goes through encryption. Some flows skip.
Or accept the leak
Translation text isn't a secret in most projects. The encryption is mostly anti-cheat; translations don't need it.
Strip from public PCK
If translations are sensitive, ship them via secure download post-install.
“PCK encryption has gaps. Decide which gaps matter.”
If you encrypt for IP protection, audit what's actually encrypted. Translations, audio, and images often leak; encryption isn't a security measure either way.