Download
Runs on your machine.
Norma 29 scans locally. Your source code is never transmitted, on any plan, and that does not change after installation.
Staging build
These are test builds. They carry their own application identity and talk to the staging API, so they keep a completely separate database from a production install — the two can sit on one machine without touching each other.
Not for real compliance work.
Your operating system will warn you
These builds carry no Apple notarisation and no Windows certificate, so both systems treat them as coming from an unidentified developer. That is a statement about our certificates, not about the file.
macOS
The first launch is blocked with “Apple could not verify…”. ClickDone, open System Settings → Privacy & Security, scroll to Security, and choose Open Anyway.
Right-clicking and choosing Open no longer works — macOS 15 removed that route.
Windows
SmartScreen shows “Windows protected your PC”. ChooseMore info, then Run anyway.
Before the first scan
An account
Needed to download rule sets and to hold your plan. Your email is encrypted on your device before it is sent, so it is never stored in a form anyone can read back — including us.
Semgrep
The semantic pass runs on Semgrep. Settings → Semgrep Engine installs it for you, or picks up the copy you already have. The other two passes need nothing.