FloDee — AI Models Used for Safety & Quality Control

AI models that reviewed this build

• Claude Fable 5 (an AI model by Anthropic) — 2026-08-02, 02:05 PDT (09:05 UTC)

Verdict

FloDee is a legitimate local desktop utility. This review found no malware, no data exfiltration, no attack functionality, and no destructive behavior that isn't user-initiated and confirmed. Nothing runs against other people's machines; everything acts on the user's own windows, files, and settings, at the user's request.

Scope reviewed

The security-relevant surface: outbound network calls, file reads/writes/deletes, the global keyboard/mouse hooks, registry access, the peer-to-peer messenger (including incoming file handling), process control, screen capture/recording, and credential/data storage. Not an exhaustive line-by-line audit of the whole codebase.

Findings

Network — only expected, declared traffic; no usage tracking.

• License check-in (activate / verify / deactivate): sends the license key and a one-way hash of a couple of hardware identifiers — never the user's name, files, or raw hardware IDs. Fails silently offline; demo users with no key make no such call.
• A "Check for Updates" button the user clicks (Help window / Settings › Help) — fetches the public build list from flodeeapp.com to compare version numbers; no identifiers sent. "Update Now" downloads the installer from flodeeapp.com and runs it only after verifying the developer's Authenticode signature (an unsigned or foreign-signed file is deleted, never run). An optional once-a-day automatic check (off by default) repeats only the version comparison; nothing is ever installed without the user choosing it.
• Install count: one POST to flodeeapp.com the first time a given version runs on a machine — a one-way hash standing for the machine (double-hashed with a salt private to this feature, so it cannot be matched against the licence fingerprint or reversed into hardware), the FloDee version, the Windows version, and whether the machine is new or upgrading. No name, licence key, file information or usage data. Sent once per version, not per launch; it has no off switch (it is the one thing the free tier asks in return) and is disclosed in the Privacy Policy and the site's fine print. Its "already sent" marker is stored in HKCU.
• A "Check Public IP" button the user clicks (queries ipify.org).
• An optional "Fetch Site Icons for Web Links" setting (Settings › Panels, off by default): when on, dropping a web link onto a User Apps panel fetches that site's own icon from that site, once. Nothing beyond the ordinary web request is sent, and with the setting off no such request is made.
• The peer-to-peer messenger, only when the user connects to a peer (TLS via SslStream), plus its same-network discovery broadcast.
• The messenger's optional Email/FTP channels relay only through the user's own configured SMTP/FTP server; the optional OBS Control panel talks only to the user-configured OBS Studio WebSocket address.
• No hidden beacons, analytics, or usage tracking of any kind — the install count above is declared and disclosed in the Privacy Policy. (A full HttpClient / WebClient / FtpWebRequest sweep of the app source confirms this list is complete.)

Keyboard/mouse hooks are not keyloggers. The global hooks react only to specific summon hotkeys and feed the on-screen Input Visualizer. Keystrokes are not stored, logged, or transmitted. Since the previous review the hooks moved to a dedicated high-priority thread so a busy FloDee can never stall system-wide input — a robustness improvement, with no change to what the hooks are allowed to see or do.

Incoming P2P files are contained. Received filenames are sanitized, and the save path is verified to resolve inside the configured download folder (rejected otherwise) — defense in depth against path-traversal.

System changes are limited and user-driven. Registry use is HKCU-only (no system-wide writes); permanent file deletion and Force-Close-All Windows ask for confirmation first, and desktop items are recycled (undoable), not destroyed.

The clipboard is only written on deliberate gestures. Copy actions (context-menu copy, Shift-expanding a tooltip, the bindable "Copy Item Under Cursor" key) run only on an explicit user action; passively hovering a file never touches the clipboard.

Data at rest is encrypted. Messages, notes, and credentials in settings.json are protected with Windows DPAPI.

Honest notes (things a scanner would legitimately flag)

These are disclosures, not damage to the user:

• Anti-piracy trackers use disguised registry paths. Demo-time enforcement stores DPAPI-encrypted blobs under synthetic CLSID keys. This is DRM, but the technique pattern-matches to what some malware does, so a security tool might flag it.
• Desktop icon positioning (Deskspaces per-monitor mode, Pachinko idle animation). To keep each deskspace's icons inside its monitor, FloDee reads and sets desktop icon names/positions through Explorer's own desktop list view (standard LVM_* window messages, which require a small cross-process buffer in explorer.exe — the same technique desktop-icon-layout savers use). It only moves icons; it never reads file contents, and files themselves are only ever moved between your Desktop and the FloDee Deskspaces folder, never deleted.
• Runtime helper scripts. FloDee generates small VBScript/PowerShell helpers in the temp folder (to read an Explorer window's folder path, or rescue windows), runs them, and deletes them. App-authored and scoped to FloDee's own data — but on-the-fly script generation is a common AV heuristic trigger.
• P2P uses trust-on-first-use, not CA-verified certificates. Peers use a self-signed cert pinned on first contact — appropriate for LAN messaging, but a first-connection man-in-the-middle isn't cryptographically prevented. A documented design choice.
• Closing an app from the Open Apps panel is forceful by design. Middle-clicking an app's icon asks the window to close, and if it's still open 1.5 seconds later, ends its process (double middle-click ends it immediately). That's the documented gesture — close means close — but an app sitting on an unsaved-changes prompt can lose that work. Refusals (e.g. elevated apps FloDee has no rights over) are reported in a toast rather than silently ignored.

About the Windows warning ("Windows protected your PC")

Some users see Windows SmartScreen or Microsoft Defender block the FloDee installer and describe it as unsafe. That warning is automatic: Windows shows it for any new program from a small publisher that few people have downloaded yet. It is not a finding about what FloDee does. Things you can check yourself:

• Every FloDee installer and program file is code-signed. Right-click the file → Properties → Digital Signatures. The certificate was issued through Microsoft Trusted Signing, whose chain ends at Microsoft's own "Identity Verification Root" — Microsoft verified the publisher's identity before issuing it, and Windows reports the signature as Valid.
• FloDee contains no AI and connects to nothing except its own licence check. It never uploads your files, notes, clipboard or captures. The full list of connections is in the Privacy Policy.
• The source was reviewed before release — the report is this page.
• The installer has been submitted to Microsoft as a false positive. Microsoft's reply will be posted here when it arrives.

If the warning appears: click More info → Run anyway, or wait for Microsoft to clear it. Nothing about FloDee has changed either way.

Bottom line

Safe to run. FloDee does exactly what it says — organize windows, panels, files, capture, and messaging on the local machine — with no hidden or hostile behavior.

Reviewed by Claude Fable 5 · 2026-08-02 02:05 PDT (09:05 UTC) · FloDee 1.0.497