Windows warning about NimbusBackup?
It's a false positive.

1. Go binaries look unusual to antivirus engines

Go produces large, statically-linked executables with no external DLLs and their own runtime. Machine-learning scanners are trained mostly on "traditional" binaries (MSVC, dynamically linked), so a Go binary stands out as atypical. And because much modern malware is also written in Go, engines weight that profile negatively.

2. Stripping + PIE = high entropy

Build flags -s -w strip symbols and -buildmode=pie randomizes addressing. The binary then looks packed or obfuscated — a classic malware signal — when these are in fact sound compilation practices.

3. Wails loads WebView2 in memory

Startup loads a loader (go-winloader) to initialize the WebView2 rendering engine. This in-memory DLL loading is also a technique used by some malware: the heuristic fires, even though it's the normal way Wails works.

4. A backup tool "looks like" ransomware

Each step is legitimate in isolation, but together they statistically resemble the profile of ransomware — exactly what behavioural detection (generic Wacatac / Sabsik families) is built to catch:

• • requesting administrator rights (UAC);
• • creating VSS shadow copies;
• • reading entire drives recursively;
• • compressing and chunking data;
• • uploading over the network (TLS) to a remote server;
• • installing a LocalSystem service.

5. No reputation yet + retroactive re-flagging

A recent binary starts with zero SmartScreen/Defender reputation. Up to 0.4.0 our binaries were unsigned, so every version started from zero. Since 0.4.1 they are signed, and reputation can build up on the same identity from one version to the next. And because definitions update continuously, a file that was clean yesterday can be flagged today with no code change — which is why the alert is intermittent.