Privacy
Zero Breach for Windows does not upload scan data. The only network access is downloading the official scanner from GitHub.
Files on your computer
Only the executable is distributed. At run time it creates a ZeroBreach-data folder beside itself for the extracted Python runtime, the verified scanner cache and an instance lock. The .NET host may also extract native runtime components into its normal temporary cache. If the executable’s current folder can’t hold application data, move it to a writable local folder.
Scan results
Scan results stay in memory unless you save a report. Temporary run files are removed after a scan completes or is cancelled. If cleanup fails, the app shows where the files were left. A previous interrupted run may leave temporary files, which the app reports at the next startup. Closing the app during a run cancels the scanner first.
Exported reports
Readable exports defang matched indicators. The original JSON export keeps the upstream raw values, including indicator addresses, usernames, local paths and browser-profile details. Share reports securely, and never visit indicator addresses to investigate them.
Network
Official downloads use network access; scan data is not uploaded. The scanner’s local socket guard is not an operating-system network sandbox.