GitHub Copilot flagged my security app as dangerous. Here's my technical response to every concern.

Someone ran GitHub Copilot's security scan on ATLOCK
and got this:

✗ No digital signature verification
✗ No source code audit possible

✗ Uncontrolled system-level access
✗ Network communication with unknown purpose
✗ Potential for data exfiltration via keyboard hooks
✗ README just says "trust me bro"

Fair concerns. Let me address every single one.

"No digital signature"

Correct. Code signing certificates cost $200-500/year.

I am 13 years old.
I have zero revenue.

Microsoft's own Sysinternals tools were unsigned
for years. Mark Russinovich built them solo.
People still used them.

Unsigned ≠ malicious.
It means indie developer with no budget.

"No source code audit possible"

The entire source code is on GitHub.
Right now.
Public.
Anyone can read it.

What Copilot actually means is it hasn't been
audited by a paid firm.

Neither has most open source software you use daily.

"Uncontrolled system-level access"

This is literally the feature.

ATLOCK uses WH_KEYBOARD_LL — a standard documented
Windows API — to block Alt+Tab and Win key.

Every parental control app does this.
Every kiosk software does this.
Windows itself exposes this API for exactly this purpose.

"Uncontrolled" is Copilot's way of saying
"I don't understand the intent."

"Network communication with unknown purpose"

ATLOCK has zero network code.

Zero.

grep the source for any of these:

• socket
• requests
• urllib
• http
• network

You will find nothing.

The Password Vault is encrypted and stored locally.
No cloud. No sync. No internet.

"Data exfiltration via keyboard hooks"

This is the most dramatic one.

Yes — ATLOCK intercepts keystrokes.
That's how it blocks Alt+Tab.

No — it does not log or transmit them.

The hook intercepts, checks if the key is
Alt+Tab/Win/Alt+F4, and if so — blocks it.
That's the entire logic. Read it yourself.

Keyloggers exfiltrate. ATLOCK blocks.
Same API. Different intent. Readable in the code.

The real issue

Copilot flagged ATLOCK because it uses powerful APIs.

Powerful APIs look scary to automated scanners
that judge capability, not intent.

A knife looks dangerous.
A surgeon's scalpel looks dangerous.
Context matters.

ATLOCK uses system-level APIs to do exactly
what it says it does — lock your system in a way
that can't be trivially bypassed.

If that makes you uncomfortable — don't use it.

If you actually read the source code and find
malicious behavior — file an issue.
I will fix it within 24 hours.

13 years old. India. Solo developer.
Akhouri Systems.

Source: https://github.com/Akhouri-Anmol-Kumar/ATLOCK
Website-https://akhouri-anmol-kumar.github.io/Akhouri-systems/

We build what others forgot to fix.