Guide 13.10
Beginner, 4 min read. Checked with Scalpel 1.12.8 on .
In short
Scalpel for Windows is a portable exe that is not signed with a paid Microsoft certificate, so the first time you open it, Windows SmartScreen says "Windows protected your PC". Check the file came from scalpeltrade.com/download, then click More info and Run anyway. You only see this on the first run of a downloaded file: in-app updates are signed and verified by Scalpel itself and do not trigger it.
SmartScreen warns about any program it has not seen many times before from a known, signed publisher. A small trading tool that ships every couple of weeks never builds that reputation, so the warning appears for everyone. It does not mean Windows found anything wrong with the file.
The full text reads "Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk." There is only a Don't run button until you click More info.
Scalpel is only ever published at scalpeltrade.com/download (and the Download panel of your account page, which serves the same file). Never run a copy sent in a chat, posted on a forum or offered by another site. If you are not sure where your file came from, delete it and download it again.
The file is Scalpel-windows-x64.exe. The download page lists the current version and its size in millions of bytes, for example 28.4 MB. Right-click your file, choose Properties, and read the exact byte count in brackets after Size: 28,412,160 bytes is 28.4 million, a match. (The figure before the brackets is in Windows' own units and reads lower, so compare the bytes.) In the SmartScreen prompt, after More info 1, the App line shows the same file name.
Click More info 1, check the App line, then click Run anyway 2. Scalpel opens to the licence screen (guide 1.3). Windows normally does not ask again for this copy of the file.
There is no installer. Keep Scalpel-windows-x64.exe in a folder you own, such as your desktop or a Scalpel folder in Documents, so the updater can replace it later. Not in Program Files: Scalpel cannot update itself there. Settings, logs and the SIM ledger live in %APPDATA%\scalpel, not next to the exe. Full setup: guide 1.1.
After the first install, Scalpel updates itself (guide 12.2). Every release is signed with our own offline Ed25519 release key, and before installing, Scalpel checks that signature against a key built into the app, plus the file's exact size and SHA-256 checksum. A file that fails any check is deleted and never runs. Because the app writes the update itself, Windows does not mark it as downloaded from the internet, so SmartScreen does not look at it.
That signature is the real proof of origin for updates: even a compromised download server could not ship you a file the app would accept.