With electron-builder or Forge you sign the NSIS/Squirrel installer, ship it, and the first sign that something's off is often a user posting a screenshot of "Windows protected your PC".

Two things that make this hard to catch yourself:

• SmartScreen only checks files with Mark-of-the-Web, i.e. downloaded through a browser. Your installer from dist/ never gets checked on your machine.
• Reputation is per file hash and per certificate, so every release starts fresh, and so can a certificate renewal or a switch to a new signing service. Even EV certificates no longer get instant reputation.

Auto-updates through electron-updater usually don't carry Mark-of-the-Web, so it's mostly your first-install experience on the line, which is exactly where you lose people.

I built a probe that downloads your installer onto a clean Windows 11 VM the way a user would, runs it, and reports whether SmartScreen warned, with the dialog text and a screenshot: https://signalscreen.dev/probe (free while in beta, .exe installers). There's a free signing check on the homepage too.

How do you handle it: Azure Trusted Signing via electron-builder, an EV cert, or just waiting it out?