This is a free tool released for the community. Nobody should have to take that on faith, so this page says what the program does, what it deliberately does not do, and how to check the download you received is the one that was published.

• No installer. It is a single file you run. Nothing is installed.
• No administrator rights. If something asks you to "run as administrator" to use this, it is not this program.
• No registry changes, no services, no scheduled tasks, no startup entries. Delete the file and it is gone.
• No background process. It runs while the browser tab is open and exits shortly after you close it.
• No network access out of the box. See PRIVACY.md for the one optional exception.
• No auto-update. The app will never download or run code on its own. If a new version exists it shows a link, and you decide.

That last point is deliberate. An app that can silently replace its own executable is an excellent malware delivery route if it is ever compromised. This one cannot.

Nothing else. It does not touch files you did not point it at.

Manually, and entirely under your control. There is no automatic update mechanism.

1. If you turned update checks on, a link appears at the bottom of the window when a newer release exists.
2. Clicking it shows what changed and a Download button for your operating system.
3. You download the new file yourself, from GitHub, over HTTPS.
4. You delete the old one, or keep it — nothing is overwritten without you doing it.

The whole program is one file, so there is nothing to uninstall and nothing left behind. Your saved cases, exported reports and data are separate files on your disk and are not touched by replacing the program.

The app never downloads, writes or runs anything by itself. That is deliberate: software that can silently replace its own executable is an ideal malware delivery route if the publisher is ever compromised. This program cannot do that, even if someone took over the release page.

Every release is published with a SHA256SUMS file listing a fingerprint for each download. If the file you received produces a different fingerprint, it is not the file that was published — do not run it.

Windows

certutil -hashfile BreakthroughSimulator-windows.exe SHA256

macOS / Linux

shasum -a 256 -c SHA256SUMS

Compare the result with the line for your file. They should match exactly.

It might, and it is worth understanding why, because the reason is boring.

The program is built with PyInstaller, which packs Python and the scientific libraries into one file that unpacks itself to a temporary folder when you run it. To a scanner watching behaviour, "single file that unpacks itself and starts an interpreter" looks structurally like a packed malware dropper, even though nothing harmful is happening. Newly published files also have no reputation yet, which counts against them on its own.

Two things have been done to reduce this:

• No UPX compression. PyInstaller will compress the executable if the UPX tool happens to be available, and compressed self-extracting binaries are one of the strongest false-positive triggers there is. It is explicitly disabled.
• Proper version information is embedded, so the file identifies itself rather than appearing as an anonymous binary.

If your scanner still objects, verify the SHA-256 first, then report it as a false positive to your vendor. Please also tell us which scanner and which version — that is useful information.

• Listens on 127.0.0.1 only. Not reachable from your network or the internet.
• Host header is validated. A web page you visit cannot reach the local server by pointing a domain name at 127.0.0.1 — a technique called DNS rebinding. Requests arriving with any host name other than localhost are refused outright.
• No cross-origin access. No CORS headers are sent, so a page on another site cannot read anything from the app even if it manages to send a request.
• Standard response headers are set: X-Frame-Options: DENY (cannot be embedded in another page), X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer, Cache-Control: no-store.
• Every input is range-checked on both sides before a calculation starts, so a malformed or hand-edited case file is rejected with a clear message rather than being fed to the solver.
• Release notes shown in the update panel are escaped, never rendered as HTML, so nothing on the release page can execute code inside the app.
• Dependencies are pinned. Each release ships requirements-lock.txt, the exact package versions the published build was made from, so a rebuild cannot silently pull a different or compromised library.

The published builds are not currently signed with a paid certificate, so Windows will show "Windows protected your PC" and macOS will say it cannot verify the developer. This is a cost decision on a free tool, not a sign that anything is wrong. Signing proves who published a file; it does not and cannot prove the file is safe. The SHA-256 fingerprints above give you the same integrity guarantee for free.

The source is not published yet. It will be released once the underlying work is written up; until then the downloads are binaries only.

That is a deliberate choice about timing, not about hiding anything, so here is what you can verify in the meantime:

• The SHA-256 fingerprints above tell you the file you received is exactly the file that was published, unaltered in transit or on any mirror.
• Every release ships requirements-lock.txt, the exact list of library versions that build was made from, so the ingredients are on the record even while the recipe is not.
• Nothing in this document is unverifiable from the outside. A network monitor will show the app making no connections at all unless you switch update checks on, and exactly one weekly request to api.github.com if you do.

If you need the source before it is published — for a review, an audit, or because your institution requires it before you may run an executable — please ask. That is a reasonable request and it will be answered.

If you find a security issue, please report it privately first rather than opening a public issue, and allow a reasonable window for a fix before disclosing. Every report is welcome, including ones that turn out to be false alarms.

Last updated: September 2026