Security & privacy

Local vault

The master password is processed with Argon2id to derive the key for AES-256-GCM authenticated encryption. Each vault uses a random salt and nonce. Decryption fails if the ciphertext or authenticated metadata has been changed.

A cached session is machine-bound defense in depth and expires after 30 minutes of idle time. It is not a replacement for operating-system account security or full-disk encryption.

SSH trust and credentials

Native SSH connections verify host keys. On first use, compare the fingerprint to a trusted value for that server. Private keys stay at their configured filesystem path unless you explicitly include their contents in a Cloud push. Clipboard copies use timed clearing when the platform supports it.

Cloud boundaries

Cloud server records use AES-256-GCM. Browser devices use P-256 keys and authorized workspace envelopes. The Cloud Access Phrase is processed on the device with PBKDF2-SHA256 at 600,000 iterations so a new enrolled device can unlock authorized workspace keys.

For browser SSH, the gateway needs decrypted authentication material briefly to establish the upstream connection. It receives this over TLS, keeps it in memory during setup, and does not write it to PostgreSQL or service logs. First connections still require host-key verification.

Anonymous installation telemetry

Released versions send one best-effort installation registration per version so maintainers can distinguish completed first-run usage from GitHub archive downloads. The payload contains only:

• A randomly generated installation UUID stored in ~/.ssher/telemetry.json.
• Operating system and CPU architecture.
• ssher version and the generic installation source.

It does not contain commands, server names, addresses, SSH usernames, vault data, account email, hostname, or device name. The API stores no IP address in the installation ledger.

macOS and Linux

export SSHER_DISABLE_TELEMETRY=1

Windows PowerShell

$env:SSHER_DISABLE_TELEMETRY = "1"

Report a vulnerability

Do not open a public issue for a suspected vulnerability. Follow the private reporting instructions in the repository’s SECURITY.md.