VirusTotal scan shows positives

VirusTotal may show hits from MaxSecure and VBA32:

• MaxSecure: Trojan.Malware.300983.susgen
• VBA32: Downloader.MSIL.gen.rexp

Those are generic heuristic labels, not "we found this known trojan." Songify is an open-source .NET app that checks for updates, talks to Spotify/Twitch, writes overlay files, and runs a small local web server. That's normal for this kind of tool, and it's also exactly the pattern those engines like to call "downloader/susgen" on small unsigned projects.

Why it happens:

• They're scoring behavior (network + file writes + updater), not a real malware signature.
• New builds have no reputation. Unsigned apps get extra side-eye from the smaller engines.
• Code signing certificates cost more than we want to spend on an open-source project, so releases don't get that trust checkmark.

How to sanity-check a download:

1. Only use our GitHub releases.
2. Compare the SHA-256 on the release with the file you got.
3. Or skip the binary and build from source.

Two heuristic hits out of ~66, plus public source, is a false positive from the updater — not a trojan. Still, only install builds from places you actually trust.