SafeInstall v0.2.0-alpha.1

SafeInstall v0.2.0-alpha.1

First public desktop alpha

This is a public testing prerelease. Windows x64 is the recommended alpha platform.

Windows

1. Download SafeInstall-Windows-x64.zip.
2. Compare its SHA-256 with SHA256SUMS.txt.
3. Extract the ZIP; do not run the executable from inside the archive.
4. Open SafeInstall/SafeInstall.exe.
5. Drag in a file, folder, or supported archive and select Start Safety Check.

No Python, pip, Git, account, OpenAI account, or OpenAI API key is required for local scans.

The Windows alpha binary is currently unsigned. Microsoft Defender SmartScreen may show a
warning because this project is new and the binary does not yet have reputation. We do not
recommend disabling Defender or permanently disabling SmartScreen.

macOS (experimental)

SafeInstall-macOS-unsigned.zip contains an experimental Apple Silicon (arm64) only build and
does not support Intel Macs. It is not signed with an Apple Developer ID and is not notarized, so
macOS Gatekeeper may display a warning. Windows remains the recommended platform for this alpha.

What is included

• PySide6 desktop interface with English and Simplified Chinese
• Drag-and-drop file, folder, ZIP, and TAR selection
• Public GitHub repository scanning
• Responsive background scanning
• Ordinary-user risk overview and capability summary
• Evidence-first technical details with rule, file, line, explanation, and recommendation
• JSON and Markdown export
• Portable Windows build and unsigned macOS development build
• SHA-256 checksums for both final ZIP assets
• CycloneDX JSON SBOM for the constrained Python application dependency environment

The portable builds intentionally do not include the OpenAI SDK. Core local scanning works
normally without it. Optional AI analysis remains available only in source installations that
explicitly install the AI extra and provide OPENAI_API_KEY.

Security boundary

SafeInstall:

• does not execute scanned code by default;
• does not install target dependencies;
• does not import target Python packages;
• does not automatically upload local files;
• does not enable AI by default; and
• does not provide a malware-free guarantee.

SafeInstall performs static risk analysis. It is not antivirus software, a malware certificate,
or a universal safe/unsafe oracle. Findings distinguish observed facts, bounded inference, and
review advice.

Verify downloads

SHA256SUMS.txt contains hashes of the exact two ZIP files attached to this release. On Windows,
use Get-FileHash -Algorithm SHA256 <file>. On macOS or Linux, use shasum -a 256 <file>.

SBOM.json is a CycloneDX 1.6 inventory generated by the Linux metadata job from a constrained
Python 3.11 application dependency environment. The validator confirms that shared critical
dependency versions match the release constraints. It is not an inventory of the exact Windows
or macOS binary contents, operating-system libraries, or every opaque binary component.

Known limitations

• Windows and macOS binaries are unsigned.
• The macOS build is not notarized.
• Deep .exe, .msi, .dmg, and .pkg analysis is not implemented.
• Static analysis can miss behavior and can report false positives.
• There is no automatic updater or telemetry.
• AI analysis is optional and is not a security boundary.

Please report sanitized alpha feedback through
GitHub Issues. Do not attach
confidential files, credentials, private source code, API keys, or unredacted scan reports.