ViraUtls — Viral Utilities Suite

Three small, local-first Windows 10/11 x64 utilities with one rule: show the user what is happening, immediately.

Each tool is a single portable .exe that opens a private dashboard in your default browser on 127.0.0.1. No installer, no account, no API key, no cloud database, no analytics, no update checks.

App	What it does
BeforeYouSend	Watches the clipboard and warns the moment copied text looks like a secret or sensitive identifier (API keys, JWTs, private keys, DB URLs with credentials, password assignments, Luhn-valid payment cards, Pakistan CNICs, IBANs).
LinkConfession	Paste a URL → see the redirect chain, tracking parameters, destination host, TLS + DNS details, and deterministic structural scam signals. Optionally sends a small GET (4 KB cap) to follow redirects manually; static mode makes no network request.
WhyIsMyPCHot?	Samples Windows CPU/GPU/RAM/disk counters and ranks the processes currently heating the machine. Uses built-in CIM/performance counters and optionally nvidia-smi. Temperature support is intentionally conservative.

Run the portable builds

1. Extract the Portable ZIP.
2. Open one product folder (BeforeYouSend, LinkConfession, or WhyIsMyPCHot).
3. Double-click the .exe.
4. The dashboard opens in your default browser.
5. Click Quit app in the dashboard when finished.

Each app may create a data/<ProductName>/ folder beside the EXE for logs, settings, and redacted history. Delete that folder to reset the app.

Windows SmartScreen note: these are unsigned development builds. SmartScreen may show "Unknown publisher" because they lack Authenticode signing and public reputation. Verify Portable/SHA256SUMS.txt before running.

Build from source

Requirements: Go 1.23+. Windows 10/11 x64 for local execution; Linux/macOS can cross-compile.

# Windows
./Source/scripts/build.ps1

# Linux / macOS (cross-compile Windows binaries)
./Source/scripts/build.sh

Builds appear in Source/dist/. Portable binaries use:

CGO_ENABLED=0
GOOS=windows
GOARCH=amd64
-trimpath
-ldflags "-s -w -H=windowsgui -X main.version=v0.1.0"

windowsgui suppresses the console window. Drop that flag for terminal debugging.

Test

go test ./...
go vet ./...

Security and privacy

• Apps listen on loopback only (127.0.0.1), never the LAN.
• Every launch generates a random 128-bit URL path token, so unrelated local pages can't guess API endpoints.
• Dashboards ship a restrictive Content-Security-Policy, frame denial, no-store, no-referrer.
• No analytics, crash reporting, or background update checks.
• BeforeYouSend never stores raw clipboard text — only redacted previews + an 8-byte SHA-256 fingerprint. Delete data/BeforeYouSend/ for a clean slate.
• LinkConfession does not submit URLs to Safe Browsing, VirusTotal, or any third party. In network mode the destination server can see your public IP + the app's User-Agent; use static mode to avoid any outbound request.
• WhyIsMyPCHot? launches a local PowerShell child process and reads Windows telemetry. No admin rights required for the normal scan. Process names and PIDs stay local.

See Source/docs/SECURITY_AND_PRIVACY.md.

Repository map

Source/
├── cmd/
│   ├── beforeyousend/   app entry point + embedded dashboard
│   ├── linkconfession/  app entry point + embedded dashboard
│   └── whyismypchot/    app entry point + embedded dashboard
├── internal/
│   ├── localapp/        localhost server, random URL token, security headers
│   ├── browser/         opens the default browser
│   ├── store/           atomic local JSON persistence
│   ├── secrets/         secret and private-data detectors
│   ├── winclip/         Windows clipboard access and warning popup
│   ├── linkcheck/       URL normalization, redirect/TLS/DNS inspection, scoring
│   └── hot/             Windows telemetry collection and heat scoring
├── docs/                product, architecture, security, and handoff notes
└── scripts/             reproducible builds and packaging
Portable/                 ready-to-run Windows x64 EXEs + readmes + checksums

Honest v0.1 boundaries

This is an MVP test build, not a production security product.

• BeforeYouSend warns after sensitive text is copied. It does not globally block the normal Ctrl+V keystroke.
• LinkConfession flags suspicious URL structure; it is not an antivirus or definitive malware scanner.
• WhyIsMyPCHot? uses a short sample. Stock Windows APIs do not reliably expose CPU package temperature or every vendor's GPU temperature.
• The Windows-specific collectors were cross-compiled and source-tested in a Linux sandbox; they still need hands-on validation on representative Windows 11 machines.

Read Source/docs/HANDOFF.md before continuing development.

License

MIT. See Source/LICENSE.