Google Ads brands a clean Rust terminal app 'malware,' then stonewalls the dev

The developer of RACE — a native macOS terminal multiplexer written in Rust — ran his first Google Ads campaign, spent $500, and had the account suspended for ‘Malicious software’ and ‘Compromised Site.’ Google offered no specifics on what was malicious or compromised, and every appeal was rejected with boilerplate; one round even earned a week-long block. The app was code-signed and notarized, and the accompanying site was a static Bridgetown page served from Cloudflare with no server-side logic and minimal third-party JavaScript.

To answer the charge, the developer ran an exhaustive self-audit: Google Safe Browsing, VirusTotal, and Search Console all came back clean, signatures and notarization verified, and both raw and bundled JavaScript showed no injected or obfuscated code. The only plausible trigger he could identify is inherent to the product itself — as a multiplexer, RACE deliberately spawns and manages persistent background shell processes so sessions survive restarts, behavior that can superficially resemble security-sensitive software. He shipped version 1.0.39 adding post-deletion cleanup of those processes, and was rejected again.

The episode is a case study in opaque platform enforcement: an accusation with no evidence, an appeals loop that never explains the actual criteria, and no way to remediate a defect you can’t see (Ads detection is treated as separate from Safe Browsing and Search Console clearance). Facing a Catch-22, the developer floated an EU redress or court route as the only path forward — until, per an update, Hacker News visibility got the account quietly reinstated, still with no explanation of what set it off.