BG3 Load Order Optimizer is an independent, community-developed third-party tool. It is not affiliated with, endorsed by, sponsored by, or officially connected to Larian Studios or Wizards of the Coast. See docs/DISCLAIMERS.md for the complete product disclaimer.

This document describes the behavior of the official v1.4.1 Windows x64 release so users and file reviewers can verify what the application does. The historical v1.3.0 package and pre-release v1.4.0 beta records remain separate from the current release identity.

The current public release is v1.4.1. It is a self-contained Windows x64 package; the published ZIP intentionally omits the optional Uninstall.exe. The older temporary command-script/self-removal process, configurable application-update redirects, and optional email-address storage are not present.

• The application does not request administrator privileges, inject into Baldur's Gate 3, modify game memory, install a service, create a scheduled task, or add itself to Windows startup.
• The application contains no telemetry, advertising SDK, analytics SDK, email-address or credential collection, automatic log upload, or background crash-report submission.
• Bug reports are shown and saved locally only when the user asks. Nothing is submitted automatically.
• Scan and Optimize are read-only. The selected profile's modsettings.lsx is changed only after the user confirms Apply Changes, Restore, Resolve Issues, or removal of an active mod. A timestamped backup is created first.
• v1.4.1: .bg3nmx Save/Load actions use an allow-listed, versioned JSON schema. The document contains mod metadata and relative ordering only; package binaries, saves, credentials, email addresses, and absolute personal paths are rejected or omitted. Loading validates against the current scan and creates a preview; it cannot write modsettings.lsx by itself.
• External Tools stores only the user-supplied display name and absolute .exe path in local settings. The optimizer launches a configured executable only after an explicit menu selection, passes no command-line arguments, performs no download, and does not itself request elevation. The selected external application may have its own permissions and behavior, so users should register only software they trust.
• The Script Extender debug-console controls change only the CreateConsole value in the local Script Extender settings file after the user clicks the corresponding command.
• Launch Game starts the user's existing Baldur's Gate 3 executable. It does not download or replace any game file.
• Save Health analysis and save comparison are read-only. The optional cleaner runs only after confirmation, byte-verifies a backup outside the live save folder, and writes a separately named test save rather than replacing the original.
• Save recovery manifests contain local save and backup paths, hashes, timestamps, and the UUIDs explicitly removed from the test copy. They remain on the user's computer under %LOCALAPPDATA%\Nemix\BG3LoadOptimizer\SaveBackups and are never uploaded.
• Script Extender save state is inspected using published serializer markers. It is reported only; the application does not delete Script Extender, Osiris, story, item, quest, or character state.

• Public Masterlist mode can download JSON rule data from the configured HTTPS masterlist address only after explicit user consent. Offline mode is supported, and Update Masterlist Now is a one-time explicit action. The default is the public Nemix3D/bg3-load-order-masterlist GitHub repository. Rule data is size-limited and validated before use; it cannot execute code.
• Check for Updates never downloads or runs an update. It displays the installed version and, with confirmation, opens the fixed official Nexus Mods page in the default browser.
• Patreon, Buy Me a Coffee, Contact, and Contribute links open only after the user selects them.
• The application does not scrape Nexus Mods or mod.io and does not send installed-mod information to either service.

The public package does not include an uninstaller. Delete the extracted app folder manually when you are finished. This does not remove BG3 mods or modsettings.lsx.

Official releases are ordinary, non-password-protected ZIP files. They are not self-extracting archives and contain no nested archives, command scripts, PowerShell scripts, source files, project files, or debug-symbol files. Release notes identify the SHA-256 of each final release ZIP so reviewers can compare the exact uploaded bytes. Future custom uploads contain the application ZIP only; checksum and provenance files remain internal evidence unless provenance is intentionally included inside the ZIP.

Windows x64 releases remain self-contained but exclude the unused .NET native debugger and dump-collection payload (createdump, DAC/DBI, and DIA Symbol Reader binaries). BG3 Load Order Optimizer does not invoke those components. Removing them does not disable the application's managed local crash reports or diagnostic-bundle features.

The published v1.4.1 ZIP is BG3-Load-Order-Optimizer-v1.4.1.zip. Its exact SHA-256 is recorded in the immutable GitHub release notes and RELEASES.md. Its release-provenance.json is a relative-path inventory and masterlist/version record, not an SBOM or a publisher signature. Future packages must pass the clean-source, package-content, exact-ZIP hash, and manual antivirus gates described in RELEASE_WORKFLOW.md before publication.

The current release is not digitally signed. A matching SHA-256 verifies the exact uploaded bytes, but it does not provide publisher authentication. Antivirus results are specific to the exact release file and scan date. Authenticode signing is planned for a future release.

Security questions and suspected false positives can be reported to nemix3d@gmail.com.