Security

How the apps are protected, and how to report a vulnerability.

Report a vulnerability

If you find a vulnerability, please do not disclose it publicly before a fix could be looked into.

If possible, include the app and its version, the Android version, the phone model, a description, the steps to reproduce and the estimated impact. Never send real personal data (passwords, messages, private files).

The project is maintained by a single volunteer. The publisher aims to acknowledge reports within 72 hours and to ship a fix within a reasonable time, with no guaranteed delay. You can be credited in the release notes if you wish.

Good-faith research, limited to your own devices and data and harming no one, will not be pursued by the publisher.

Supported versions

Only the latest released version of each app receives security fixes.

Technical measures shared by all seven apps

  • Signed APKs; the signing keys are kept in no code repository.
  • Production builds optimised by R8, not debuggable; Android's automatic backup disabled.
  • No telemetry, no advertising or analytics SDK, no Files Tech server.
  • No app accepts cleartext network traffic; three of them do not even hold the Internet permission.
  • The apps that keep sensitive data encrypt it on the phone, with a key derived from your secret or held by the Android Keystore.
  • SHA-256 fingerprint of every APK published in the GitHub release notes.

Each app's own details (algorithms, threat model, known limits) are in the SECURITY.md file of its repository.

Verify an APK

Before installing it, compare the file's SHA-256 fingerprint with the one published in the GitHub release notes (see the download page):

sha256sum file-name.apk

Audits

The apps are audited by the publisher before releases: code reviews, automated analysis tools, reviews assisted by artificial intelligence, and checks on real devices. These are not audits by an independent body, nor a certification. Findings and their fixes are documented in the repositories.