#1 Question about codebase origin, monolithic architecture and @google/genai dependency

[Anonymous]

Originally created by: glebtsarenko43-sys

Hi @orloxgr,
First off, thanks for open-sourcing ClamShield — the feature set is impressive and the README is very detailed.
I’m doing a pre-install audit of the project before deploying it in my environment, and I have a few questions that would help me (and other potential users) build trust:
AI-assisted development — Was a significant portion of the codebase (especially the ~443 KB monolithic server.ts) generated or heavily assisted by an LLM? The UI polish and the sheer size of the single backend file feel unusually "complete" for a solo open-source project, so transparency here would be appreciated.
@google/genai dependency — package.json lists @google/genai, but the README doesn't mention any Gemini/GenAI integration. What is this dependency used for? If it's unused, are there plans to remove it?
Monolithic server.ts — The entire backend logic lives in one file. Is this intentional for now, or is there a roadmap to split it into modules? It makes security auditing quite difficult.
Missing CI/CD and tests — There are no GitHub Actions workflows and no test suite. For a security product that runs with admin privileges and disables Windows Defender, this is a hard sell. Are these on the roadmap?
Binary provenance — The released .exe appears clean on VirusTotal, but since there's no reproducible build or code-signing transparency log, how can users verify that the published installer matches the source in this repo?
I’m not accusing the project of anything malicious — the code I've read looks legitimate — but for a tool that asks users to pause Microsoft Defender and grant admin rights, a little more transparency on development practices would go a long way.
Thanks for your time.

[Anonymous]

Originally posted by: orloxgr

Hi, thank you for the thoughtful audit and for raising these points in such a constructive way.

I want to be fully transparent: ClamShield is an AI-assisted project to a very large extent. I have no problem saying that openly. That said, it is not a low-effort AI dump. I have spent a lot of time designing the product, reviewing behavior, testing flows manually, refining safety warnings, fixing edge cases, and shaping the application with care. It is a project I built with genuine attention and dedication, not something published casually.

Regarding @google/genai: that is a leftover from the project’s early origin. ClamShield started from a Google/Gemini-oriented scaffold/workflow, but I later moved away from that in favor of another AI development workflow that suited me better. ClamShield does not currently use Gemini/GenAI at runtime, and it does not send scan data or files to Google. I will remove the unused dependency and clean up the .env.example file.

The monolithic server.ts is a fair criticism. It grew during rapid beta development, and while it made iteration faster, I agree it makes auditing harder. Splitting the backend into clear modules is on the roadmap.

You are also right about CI, tests, and binary provenance. At the moment the release process is manual, and that is not ideal for a security-adjacent tool running with administrator privileges. My next steps are to add GitHub Actions for type-check/build validation, start adding focused tests around critical flows, publish SHA-256 checksums for releases, and document the build environment more clearly.

Thanks again for taking the project seriously enough to ask these questions. This kind of feedback helps make ClamShield more trustworthy and easier to audit.