Skip to content

Security Information

We take security seriously – not as an empty promise, but as a core ingredient of our software development process.

Vulnerability transparency

We publish security advisories for our software on GitHub:

The same GitHub pages allow you to report a vulnerability privately and securely.

Please do not report security issues using public Issues or any other means of communication except for the GitHub Advisories pages linked above.

Code signing

All released binaries are signed.

  • On macOS they are signed with a Developer ID and notarized by Apple.
  • On Windows the releases are Authenticode-signed with Azure Artifact Signing.
  • On iPad and iPhone the app is, of course, signed with a Developer ID and notarized by Apple.

Unfortunately, Linux does not have any support for signing the binary. We recommend building it yourself from source if you want to be extra certain it has not been tampered with. Please note that due to the way Boson, the application framework we use, builds applications the builds are not reproducible i.e. the hash of the binary will differ on each build.

Secrets storage

All sensitive information (Joomla API tokens, AI access tokens) is stored securely, using the secure storage features provided by your operating system:

  • On iOS, iPadOS, and macOS we use the system keychain.
  • On Windows we use DPAPI.
  • On Linux we use libsecret.

Your content is NOT encrypted in any way. It is stored as plaintext on-device. Security of your content at rest is the responsibility of your Operating System, typically met with Full Disk Encryption (e.g. FileVault on macOS, BitLocker on Windows, or LUKS2 on Linux).

HTTPS required

Your Joomla site must use HTTPS with a valid, signed TLS certificate. This is an intentional security control. Joomla API tokens allow their holder to take any action as the token's linked user. Tokens are not scoped, and never expire unless manually rotated. We require HTTPS to prevent token leaks due to a MITM or network inspection attack.

If you are using AI features your content (and possibly media) are transferred to the service providing AI inference. This may have privacy or confidentiality repercussions.

We strongly recommend using a local AI inference provider, running on your device. Nothing leaves your device.

If you'd rather not risk it, we have an AI kill switch. When you use it to disable the AI features, it will not only hide them but programmatically lock them out from making network requests.