Before a build leaves here it has to pass three things.
Every test passes. A single warning is enough to stop a release.
It runs from a strange folder. The game is copied into a folder it has never seen and opened there. If it wrote anything outside its own folder, that build does not go out.
One zip, no installer. Inside it is a plain folder. There is no self-extracting archive and no exe squeezed into a single file, because that is the first thing antivirus programs get upset about.
We put a checksum next to the zip as well. After downloading you can type
Get-FileHash -Algorithm SHA256 <file> in PowerShell and compare the number with the one on the
download page. If they match, the file did not get damaged on the way.
The game is not signed yet, so the first time you open it Windows will say it does not recognise the program. The only cure for that is buying a signature. Until then, the "First run" part of the download page walks you through it step by step.