SuperSQESuperSQE

Docs / Security

Windows SmartScreen / Defender says "unknown publisher" or deletes the installer

Why does this happen?

SuperSQE is a self-contained installer — it bundles its own Node.js runtime, PostgreSQL database, Playwright browsers and the runner agents into a single file. That is exactly what legitimate products do, but it also matches the pattern of "installer bundlers", so Microsoft's cloud reputation engine occasionally flags the unsigned installer as Program:Win32/Contebrew.A!ml.

This is a false positive. The installer is the official SuperSQE distribution: every download ships with its SHA256 checksum, published on the Downloads page, and the checksum matches the file exactly.

The definitive fix is a code-signing certificate (which gives the installer reputation with Windows). Until SuperSQE signs its installers, the workarounds below let you install safely.

Option 1 — SmartScreen "More info → Run anyway"

  1. Right-click the downloaded supersqe-setup-*.exe → Properties.
  2. If you see Unblock at the bottom, tick it and click OK.
  3. Run the installer. When the blue SmartScreen screen appears, click More info → Run anyway.
  4. Verify the SHA256 checksum first (see Option 4) — then it's safe to run.

Option 2 — Restore a deleted file

  1. Open Windows Security → Virus & threat protection → Protection history.
  2. Find the SuperSQE entry → expand it → Actions → Restore.
  3. Right-click the restored file → Properties → Unblock → run it.

Option 3 — Verify the checksum before running

Open PowerShell in the download folder and run:

Get-FileHash .\supersqe-setup-1.0.2-x64.exe -Algorithm SHA256

Compare the output with the SHA256 shown on the Downloads page. If they match, the file is the official, untampered installer.

Option 4 — Report the false positive to Microsoft

Help us clear the detection for everyone:

  1. Go to Microsoft Defender Security Intelligence submission.
  2. Sign in, upload supersqe-setup-1.0.2-x64.exe and select "This file is incorrectly detected".
  3. Microsoft typically whitelists the file within a few days.

Signed installers are coming

SuperSQE is adding a code-signing certificate to its release pipeline. Signed installers are trusted by Windows automatically.

Checksums are published

Every release publishes its SHA256 checksum on the Downloads page. Verify before you run — a mismatch means the file was tampered with.

Never disable Windows Security globally. Only unblock the specific installer after verifying its checksum.