Check the download
Make sure the file you downloaded is the one that was released, before you install it.
Releases aren't code-signed yet, so the install steps get past macOS's and Windows's warnings. Before you do that, check the download is the one released: its SHA-256 must match the one on the release page, which is also in the release's SHA256SUMS.txt.
On macOS
In Terminal, with the version you downloaded:
shasum -a 256 ~/Downloads/Sineless-<version>-macOS.pkgOn Windows
In PowerShell:
Get-FileHash $HOME\Downloads\Sineless-<version>-Windows-Setup.exeIf the value doesn't match, don't install the file: download it again, and if it still doesn't match, report it privately.