Security before scale.
Our intended security posture for public distribution, clearly separated from features still pending in the desktop client.
Website protections
This site is a static product website. It has no public login endpoint, no embedded router credentials, no remote terminal bridge, no third-party analytics scripts and no live payment form. Hosting should use HTTPS with controlled DNS, access protections and tested deployment processes.
- HTTPS/TLS managed by hosting provider.
- Restrictive content security policy and browser permissions.
- Account MFA for domain registration, hosting and repository access.
- DNSSEC where supported, with recovery codes safely stored.
Desktop application boundaries
Do not treat v1.3 as security-certified. The existing prototype has not yet completed a public penetration test, independent code review, credential vault assessment or comprehensive device compatibility certification.
Before recommending this client for sensitive production environments, it needs robust SSH host-key verification, reviewed credential storage, secure connection handling, protections against downgrade attacks and testing on supported network devices. Stable updates should be signed and verified.
Accounts and identity
An email OTP server prototype has been developed separately, but it is not integrated into the desktop application. A public product should integrate Google and Microsoft identity-provider sign-in using an appropriate native desktop OAuth flow with PKCE and MFA, where supported. Do not distribute SMTP passwords or API secrets in the EXE.
Email-only OTP is not equivalent to phishing-resistant MFA. Central services must implement rate limiting, revocation, monitoring and secret rotation if accounts are introduced.
Keep management interfaces private
- Connect directly from the local desktop to authorized devices wherever possible.
- Use SSH, not Telnet, for normal remote management.
- Use SFTP/SCP rather than plain FTP for sensitive configuration files.
- Keep management access behind a VPN, bastion or dedicated management network.
- Apply least-privilege device roles, logging and change control.
Free experimental downloads and future releases
The current v1.3 executable is publicly downloadable without registration and is unsigned and experimental. Its published SHA-256 checksum helps detect download corruption or tampering, but does not prove that the program is safe. Security auditing, verified developer signing, hardening and upgrade testing are required before a recommended stable production release.
External donations
The optional support link opens an external PayPal checkout. This site does not host card-entry fields, collect payment credentials or require donations to download software. PayPal controls the actual charged amount and currency, configured in the merchant account.
Security vulnerability reporting
A dedicated security reporting inbox will be published before public software distribution. Until then, do not submit passwords, private keys, router configuration files or exploit data through this website; it has no upload or reporting form.
Security is an ongoing process. Neither TLS certificates nor a signed executable guarantee a system is free of vulnerabilities. A controlled beta and professional security assessment are still required.