Built safety-first · simulation by default
Fair question in a niche full of scams. Here is exactly how the software is built, stated as what it does today, not as a promise about anyone's enforcement. Five pillars, in plain language.
It runs on your machine. We never hold your Steam credentials.
The app is local-first. Your CSFloat key and Steam session live in your own OS keychain, used only by the bot running on your computer. They are never sent to us, never put in the dashboard bundle, and never written to logs. The license verifies offline against a baked-in public key.
Simulation by default. You can run the whole engine before anything touches your account.
It ships in paper-trading mode. The full scan, score, and decision loop runs against live prices with no real money and no live Steam action. Live execution only happens when you deliberately disable simulation, pass the backend guard, and hold a valid pro license. A missing or invalid license keeps it in simulation.
It shows the after-fee, after-hold result, including losing trades.
Every opportunity is scored on net margin after seller fees, the 7-day Steam hold cost, and a float-bucket comparison. A "cheap" listing that loses money never reaches the top, and a losing trade shows in red. Try the same math in the calculator.
Steam Market buying is unsupported by design, so the bot can't perform the action that most often gets accounts restricted.
Every venue action is rated auto, assisted,
manual, or unsupported. The executor only auto-runs
auto ops. Steam Market buy is unsupported, and
the read-only connectors keep buy, list, and deliver at manual or
unsupported. This is enforced in the backend, not the UI.
Arbitrage can lose. Holds tie up capital. No tool controls Valve.
Profits here are real but thin. The 7-day hold locks your capital, float and liquidity can turn a "profit" into a loss, and the unofficial APIs the app reads can break without notice. The software is engineered to refuse the actions that most often get accounts restricted, but no tool can promise zero risk or control how Valve enforces its rules. Trade only your own account, keep volumes sane, and read the terms and EULA before going live. This is not financial advice.
Provided AS-IS, with no warranty, and not financial or trading advice. You are solely responsible for compliance with the Steam Subscriber Agreement and every marketplace's terms. Not affiliated with Valve, Steam, CSFloat, or any marketplace named here.
This table is generated from the same capability matrix the executor routes on. The bot
only auto-runs auto operations; everything else queues for you. An automated
test fails the build if this page ever drifts from the code, so what you read here is what
the software actually enforces.
| Venue | Quote | Buy | List | Deliver | Inventory |
|---|---|---|---|---|---|
| CSFloat core | auto | auto | auto | assisted | unsupported |
| Steam Market core | auto | unsupported | manual | manual | unsupported |
| Skinport | auto | manual | manual | unsupported | unsupported |
| DMarket | auto | manual | manual | unsupported | unsupported |
| BUFF163 | auto | manual | manual | unsupported | unsupported |
| BitSkins | auto | manual | manual | unsupported | unsupported |
| Waxpeer | auto | manual | manual | unsupported | unsupported |
| CS.MONEY | auto | manual | manual | unsupported | unsupported |
| Pricempire | auto | unsupported | unsupported | unsupported | unsupported |
The Windows installer is digitally signed through Microsoft Azure Trusted Signing, so Windows can confirm who published it. You do not have to take our word for any of this. Here is how to verify the file on your own machine before you run it.
On a fresh download you might see a blue "Windows protected your PC" box that says
Microsoft Defender SmartScreen "prevented an unrecognized app." That is not the old
"Unknown publisher" warning. Windows knows exactly who signed this build. Click
More info and it shows Publisher: Wesley Sander.
SmartScreen also tracks reputation, which a brand-new signed app has to earn as more people download it. Until it does, that prompt can appear even on a correctly signed file. To continue: click More info, confirm the publisher reads Wesley Sander, then click Run anyway. Every release is signed with the same identity, so the prompt fades as reputation builds.
A hash is a fingerprint of the exact bytes you downloaded. Run this in PowerShell in your Downloads folder and compare the result to the value below.
Get-FileHash .\noban-Setup.exe -Algorithm SHA256
a76f3fd26e03410ba6b7ef88d161b8328227d61108cde17a52eda8444c66e182
For noban v1.1.0. The same values live in
the release notes
and its SHA256SUMS.txt, which always track the current build.
Prefer a second opinion? Check the file against 70+ antivirus engines on VirusTotal using its hash. No upload needed once it has been scanned.
View the VirusTotal report for v1.1.0
You can also right-click the installer, open Properties, and read the Digital Signatures tab to see the Wesley Sander certificate directly.