Please do not publish unpatched security vulnerabilities in a public issue. Report them privately to the repository maintainer.
DownGo never intentionally executes downloaded programs automatically. ZIP extraction validates paths before writing files. Microsoft Defender integration uses the local Windows security configuration.