How PATANYX updates itself
Windows may warn you about PATANYX the first time you download it. That warning is reputation-based: SmartScreen has not seen this release from this publisher enough times yet to have an opinion about it. It is not a malware detection. The download page tells you what to click, "More info, then Run anyway."
The question worth asking comes after install. A browser updates itself for years. What stops one of those updates from being something you did not agree to? The short answer is that the browser does not trust the server it downloads from.
The key it checks against never came from the network
PATANYX updates itself over its own signed channel. Each update is described by an Ed25519-signed manifest, and the browser checks that manifest against a key compiled into it. That is the whole design. A compromise of the server, its DNS, or a certificate for it still cannot make an install accept a modified update, because the key the browser compares against never came from the network.
Checks happen on a schedule, and a verified update can download in the background. Nothing installs until you choose to restart. Background download is on by default and can be turned off in the Updates panel.
A signed blocklist is fetched the same way.
What an update check actually sends
A scheduled check runs roughly every six hours, with wide random jitter. The jitter is deliberate: an exact interval would itself be a fingerprint, a regular heartbeat that identifies one install across time. There is also a "Check now" button if you would rather not wait.
The check is one unconditional GET per platform, and that is the entire request. A signed engine-safety advisory rides alongside it on the same schedule, to the same host, with the same shape. No cookies. No authorization header. No version number in the request. The browser downloads the manifest and does the comparison locally, which is why the request carries nothing about you.
What the server does see is an IP address and a timestamp. That is unavoidable for any network request, and the browser's own update panel says so rather than leaving you to assume otherwise.
One detail worth knowing if you read your firewall logs: the update manifest and blocklist channels are fetched from patanyx.edgexene.io, while the site itself is patanyx.net. Traffic to that host from PATANYX is the update channel doing its job.
Who signed the installer
The Windows binary is Authenticode-signed. The publisher name Windows shows you is an individual person's name rather than a company name, because the signing certificate was issued to the founder personally. The download page names the person in advance, so the dialog is not a surprise.
Every release is also signed with Sigstore, and the signature is recorded in a public append-only log. That log is the point: a signature that exists in a public record cannot be quietly issued for one target and denied later.
Check the download yourself
You do not have to take any of the above on faith for the file already sitting in your Downloads folder. The SHA-256 of each download is printed under the download button.
On Windows, in PowerShell:
certutil -hashfile "$env:USERPROFILE\Downloads\PATANYX.exe" SHA256
On Linux:
sha256sum ~/Downloads/PATANYX
Compare the output to the hash on the download page. If they match, the bytes you have are the bytes that were published. If they do not, do not run the file.
You are not asked to trust the server
Most of what a browser asks you to trust is invisible. You click through a warning, the installer runs, and from then on the software updates itself on a schedule you never see, from a server you have no way to inspect. The design above does not ask you to trust the server. It asks you to trust one key, which shipped inside the browser you already verified by hash, and it leaves the rest checkable in public.
The one thing it will not do is decide for you. A verified update sits and waits until you restart.
Full checksums and verification steps are on the download page. What the update check reveals is covered in the privacy policy, and the rest of the browser is documented in the guide.