Code signing policy

What is signed

2XPing.exe inside the release zips on github.com/ldo2x/2XPing/releases. Nothing else is signed with this certificate.

• Every release is built from the tagged source code of this repository by GitHub Actions (build.yml), never on a personal PC.
• The build is sent to SignPath, and each release is approved by hand before it is signed.
• The signed files carry the product name 2X Ping and the release's version.
• The .sha256 file of each release is made from the signed zip; the in-app updater checks it before installing.

Status: signing is being set up. Until the first signed release, 2XPing.exe is unsigned and Windows may show "Windows protected your PC".

Team roles

Privacy

While it is open, 2X Ping sends beta usage statistics to the developer's own database (Supabase). The first-launch screen tells you and links to the full list. Share beta statistics in Settings is on by default; turned off, only anonymous usage is sent: no name, PC name, location, internet provider or PC details, and no location lookup.

Everything that is sent, where it goes, and the other services the app contacts: privacy policy.

Check the signature

1. Right-click 2XPing.exe > Properties > Digital Signatures.
2. The signer should be SignPath Foundation. If the tab is missing or names someone else, don't run it and tell us.

Uninstall

2X Ping has no installer. Press Unlock (or Back to normal in Settings), close the app, then delete its folder. To remove its settings too, delete %APPDATA%\2XPing.