Security

Local-Only

The diagnostic makes no network calls, sends no telemetry, and writes only to the output folder you choose.

The diagnostic does not dump raw environment variables into its HTML, Markdown, and JSON reports.

For tool checks, the diagnostic uses fixed version and status arguments such as --version, wsl --status, and wsl -l -v, but it runs the executables Windows resolves first on PATH. Review PATH warnings before trusting tool-version evidence, especially if duplicate tool installs are reported.

Use a normal project or kit output folder such as .\reports. Writing reports to Windows system folders, Program Files folders, full user-profile roots, or network shares is unsupported.

No Admin Elevation

The diagnostic does not require admin privileges and does not request elevation.

Redaction

Reports redact common secret-like values before HTML, Markdown, or JSON is written. Redaction tests plant fake OpenAI, Anthropic, GitHub, AWS, Google, Slack, Stripe live-key, JWT, private key, npm, bearer token, and generic secret-assignment examples.

Support bundle and submission checks also reject suspicious high-entropy token-shaped values before support review. Redaction is a safety layer, not a complete secret audit; inspect reports locally before sending them.

SmartScreen and Antivirus

Windows or antivirus tools may warn about downloaded scripts or zip files. Do not bypass warnings unless the SHA256 checksum matches the published checksum and you are comfortable inspecting the PowerShell source.

If antivirus quarantines the zip, contact support with the engine name and detection label. The diagnostic does not require admin elevation, does not modify system settings, and writes reports only to the output folder you choose.

Release Checksum

Current release zip SHA256 checksum:

C36942C2B5653EA1B65A46990B3B8EADF0A481835142217F07C12622AD12379B

Code Signing

The paid beta may ship unsigned. The post-beta plan is to sign release artifacts and publish certificate identity and checksums.

Independence

This product is independent and is not officially affiliated with ECC, Anthropic, OpenAI, Claude, Codex, Microsoft, GitHub, Cursor, or Windsurf.

What Not To Send

Do not send .env files, credential files, auth files, browser profiles, SSH private keys, API keys, tokens, or passwords.