The app works end to end and is tested from the packaged installer. What
it doesn't have yet is a code signing certificate — and releasing without
one would put a full-screen scare in front of the people it was built for.
Why that matters more here than usual
When Windows meets a program it has never seen from a publisher it has
never heard of, SmartScreen shows a blue
“Windows protected your PC” screen, and hides the
Run anyway button behind a More info link.
That message means “Windows has not seen this file before”
— not “this file is harmful”. But LanderSync is built for people who
were told, correctly, never to click through warnings like that. Handing
them one on the very first screen is a bad way to start.
So the signature comes first, and it's coming from the
Microsoft Store. Apps published there are signed by
Microsoft itself — which means not a smaller warning, and not one that
fades away once enough people have downloaded it, but no warning at all.
Publisher verification with Microsoft is under way now.
Nothing is hidden in the meantime. Every line of source is
already public, the installer is built in the open by GitHub Actions, and
an early build sits on the
releases page
for anyone who wants to look. It just isn't being recommended to anyone
until it's signed.
SIGNING.md
documents exactly what the app connects to and how your Cloudflare key is stored.