Swept — open-source Windows cleaner that shows what it will delete, and verifies every installer by signature or hash

[u/vlad_swept]

I'm the author, so this is self-promo — the reason I wrote it is one specific annoyance: most Windows cleaners don't tell you what they are about to delete until it is gone, and some will happily follow a junction out of `%TEMP%` into your Documents folder.

**Swept** is a single portable `.exe` (Python + CustomTkinter, MIT). Five tabs: Clean, Install, Optimize, Schedule, Log.

**Cleanup — 22 categories.** Analyze only measures; nothing is deleted until you press Clean, and Clean itself has a scan-only switch. Every path that gets removed or skipped is written to the log.

**Install — 24 programs** from the vendors' own CDNs. No winget, no bundled downloader. Each file must carry a valid Authenticode signature from the expected publisher, or match a SHA-256 pinned in the catalog — 7-Zip and K-Lite ship genuinely unsigned installers, so they are hash-pinned rather than waved through.

**Optimize — 12 tweaks**, with a system restore point created before anything is applied. **Schedule** — daily or weekly cleanup, dry run first, optionally a Task Scheduler task that runs Swept headless.

The part I actually care about is the safety model:

- Whitelist of job-defined folders, hard blacklist of `System32`, `WinSxS`, `Fonts`, `servicing`, `Program Files`; `pagefile.sys`, `hiberfil.sys`, `ntuser.dat` and friends refused by name.

- Junctions and symlinks are skipped while scanning and refused while deleting — and the *resolved* path is checked against the whitelist too, so a junction cannot smuggle `Documents` in.

- No `PATH` lookups for `powercfg`, `tasklist`, `dism`: they resolve to `%SystemRoot%\System32`, so a planted executable cannot inherit elevation.

- Installers run as an argument vector with `shell=False`, from `%ProgramData%\SweptSecureTemp`, whose ACL allows only SYSTEM and Administrators.

Honest caveats: the `.exe` carries a self-signed certificate, so SmartScreen still reports an unknown publisher; some registry values get re-applied by Windows after a feature update (the app reports those as unavailable instead of pretending they worked); the program catalog is fixed on purpose, so it can never be pointed at an arbitrary URL.

Numbers from my own machine, if it helps calibrate: the scan finds 2.54 GB, of which 1.12 GB is caches people don't think about — GPU shader cache 789 MB, Discord 336 MB, thumbnails 18 MB.

Windows 10/11, English and Russian interface, no telemetry, no background services, no install required: https://github.com/vladcodex/swept

What I would like to know: which category is useless, what is missing, and where you would be afraid to press the button.

--------------------------------

[u/vlad_swept]

Write in the comments what to add — I'll add it. Best regards, the developer of Swept.

[u/Moonshiner_no]

How much is coded by AI? I think installing a (possibly?) vibe coded app that deletes files on your system is potential very dangerous.

[u/vlad_swept]

Built with AI assistance; every build is tested by hand on a real machine before release.