Security

We aim to minimize risk by keeping sensitive data on-device and providing transparent controls.

Design Controls

• Local-first: API keys live in your browser’s storage.
• Explicit actions: Only you initiate provider calls or backups.
• CSP: A Content-Security-Policy restricts resource loading to trusted origins.

Optional Encrypted Backup

If enabled, your data is encrypted client-side with a password key before being sent to MasterAuth (api.brandon.my). You can opt out entirely and keep all data local.

Phishing & Social Engineering

• We will never ask for personal account passwords or payment details.
• We do not bundle downloads or installers.

Report a Security Issue

If you suspect a security or privacy issue, please open an issue in the repository or contact the maintainer.

Back to app