SIGF app/Is SIGF safe?

Is SIGF safe?

Short answer: the SIGF app is open source (AGPL-3.0), it changes only what a mashup needs, it keeps a copy of everything it changes, and it can put your games back. Here is exactly what it does, so you can judge for yourself.

Quick answers

Is SIGF safe?

The app never asks for admin rights, doesn't run in the background and collects no telemetry. Before it changes a game file, it saves a copy of the original, and Restore vanilla puts the original files back. Restore can't undo files the game creates while you play (saves, settings, logs).

Why does Windows warn me?

The installer is not digitally signed yet, so Windows SmartScreen can show "Windows protected your PC". Click More info → Run anyway. To check the file first, verify its SHA-256 as shown on the download page.

What the app does on your PC

• It finds your games by reading your launchers' install lists: Steam's library files, Epic's install manifests, GOG's and Ubisoft's install entries in the registry, and the folder names of Prism Launcher, the Modrinth App and Minecraft.
• It never touches your logins. It does not read Steam, Epic, GOG, Ubisoft or Minecraft account files or tokens. Minecraft sign-in stays in Prism Launcher.
• It never asks for admin rights. No service, no driver, no startup entry, no scheduled task, no firewall rule, no antivirus exclusion.
• It doesn't run in the background. Close the window and it's gone.
• No tracking. No telemetry, no analytics, no crash reports, no ads, no account.

What happens when you click Get

1. The app downloads the mashup's files from its GitHub release (or the one pinned upstream release a mashup is built from; Minecraft pack files come from Modrinth's CDN), over HTTPS only. The app itself refuses any other host. A mashup that builds a file on your PC also gets pinned sources from GitHub and, once, a compiler and Python from their official downloads (GitHub, python.org), all hash-checked.
2. A mashup that uses your own copy of a game file (a ROM you dumped) finds it on your PC or asks you to pick it, checks it, and copies it into its own folder. SIGF never ships, downloads or uploads that file.
3. It checks every file against the fingerprint (hash) published with the mashup. If a single byte differs, the install stops.
4. Before it changes a game file, it saves a copy of the original.
5. It writes only inside the game's folder, the game's folder in your Documents, the launcher folder a mashup needs (FiveM, Prism Launcher) or SIGF's own folder. It installs only into game folders its own scan found. Paths that try to escape those folders are refused.

Restore vanilla

Restore vanilla puts back every original file byte for byte and removes the files the mashup added. If the game changed those files since (for example after an update), it asks you before doing anything. Files a mod writes on its own while you play (saves, logs, generated assets) are not tracked and stay.

What Restore can't undo: files the game or mod creates while you play (settings, logs, saves), and anything sent to a game's online service. Uninstalling SIGF doesn't restore your games, so run Restore vanilla first (the uninstaller warns you if mashups are still installed).

Invite links

Clicking a SIGF invite link opens the app and shows you the mashup and its version, who made it, who is hosting, the games it will change and the server address you will join. Nothing is downloaded, installed or launched until you click Install & join (or Join when you already have that exact version).

What leaves your PC

• To show lobbies you can join, the app sends sigf.ai the ids of the games you own (only games SIGF has mashups for). You can turn this off.
• When you host, your name and join address are shared with anyone who has your invite link. The app puts your PC's local network address in it only when you click Use my LAN address, or when you chose Fill in for me.
• Pictures come from Steam's, Epic's and Modrinth's image servers, which can see which games are on screen. For a few games with no picture, the app searches the Steam store by the game's name. You can turn both off.
• Downloads come from GitHub and Modrinth, which see your IP address like any download. The app also asks GitHub for its own latest version when it starts and every 6 hours, and updates only when you click Update and restart.

The first time the app starts, it asks you about each request you can turn off, before it sends anything but the catalog request. Your game list, folders and installed mashups stay on your PC. The details are on the privacy page.

How the mashup library is checked

Every community mashup goes through a check before it gets a one-click install:

• Static review only. We read the mod's source and its release files; nothing from the mod is run during the review.
• Virus scan. Release files are scanned with Microsoft Defender. Every prebuilt file (.dll, .exe, .jar and so on) is listed, and a binary with no matching source is a red flag.
• Red-flag search. We search the source for downloaders, startup entries, antivirus exclusions, admin elevation, access to account files or tokens, webhooks, unknown network hosts and obfuscated code.
• Content rules. SIGF ships no ROMs and no ripped game assets, and nothing that touches a game's official online mode or bypasses anti-cheat for online play. A mashup may use your own copy of a game (a ROM you dumped): the app checks it on your PC and never ships it, and files that may not be shared (built from a game's decompiled code) are built on your PC, never shipped by SIGF.
• Hash pinning. Each listed version is pinned file by file to its hash. The app installs exactly that version and nothing else.
• Credit to the authors. Each card names the author and links to their project. A mod whose license doesn't allow re-hosting is linked, not re-hosted. When a project has no usable release, SIGF builds it from a pinned commit of its source on a disposable build machine.
• Beta label. Community mashups are labeled beta, and their card links to the author's bug tracker so you can report bugs to the people who can fix them.
• Submissions too. A modder can submit their mashup. An automatic pre-check reads only public GitHub data, then the submission waits for this same review. Nothing is listed without it.

The sigf.ai catalog only accepts a mashup whose every file is a release file of the GitHub repository it credits, with a hash and size. Minecraft pack entries come from Modrinth's CDN, each with its own hash.

What this check can't promise. Mods are programs that run inside your game with your rights. The review and the hashes make sure you get exactly what was reviewed, from where it was published. They are not a guarantee that a mod has no bugs or no harmful behavior that a review missed. If something looks wrong, tell us and we will pull it from the catalog.

Mashup cover art is AI-generated by SIGF and only evokes the games: no game logos, screenshots or files from the publishers.

Check it yourself

• Read the source: github.com/SIGFAI/sigf-app.
• Verify your download: each release lists SHA-256 checksums and a build attestation that proves it was built by GitHub from the public source. See the download page or the README.
• Report a problem: security policy.