Security
Credential protection, encrypted transport and explicit trust boundaries.
AeroFTP is designed with security at every layer. From Rust's memory safety guarantees to encrypted credential storage and credential isolation for AI agents, we take your data protection seriously.
Security Architecture
Memory Safety
Rust reduces memory-safety risks, but application and dependency code are not universally free from vulnerabilities.
Encrypted Credential Vault
The local vault uses AES-256-GCM per entry. Its unlocking passphrase normally uses the OS keyring; master-password mode adds Argon2id-based protection. A permission-protected on-disk fallback may store the passphrase beside the vault.
Credential Isolation
Saved-profile credentials are resolved by the backend. Tool results can still contain private paths and file content, and approval behavior depends on the mode and tool.
Desktop Privacy
The desktop has no product analytics or automatic crash reporting. Transfers, background services, update checks, optional AI/MCP endpoints and enabled discovery can make network requests.
TLS & SSH
Choose verified TLS or SSH for encrypted transport. Plain FTP is unencrypted. Configure certificate and host-key verification for your connection.
Optional Vault TOTP
TOTP setup requires verification. The implemented vault-unlock paths protect against consumed-step replay and persist throttling state. Security architecture and limitations.
Self-Hosted Continuous Audit
Vendor-independent pipeline, reproducible by anyone who clones the repository
Three independent sources
We aggregate cargo audit (RustSec database), npm audit (npm registry) and osv-scanner (Google OSV). osv-scanner catches GHSA advisories that have not yet landed in RustSec, giving cross-ecosystem coverage.
Documented suppression list
Every accepted advisory lives in src-tauri/.cargo/audit.toml with an inline threat model. Reviewers can audit each rationale and push back specifically. No blanket ignores.
Reviewers can verify, not just trust
Anyone can clone the repository, run npm run security:report, and produce a new report against the current dependency and advisory snapshots. There is no "trust me, the dashboard says zero" step. Published HTML reports are dated evidence, not a fresh result for the installed release.
No vendor lock-in
The pipeline is GPL-3.0 like the rest of AeroFTP and runs against open advisory databases. If any vendor ends a free tier, gates a feature or rate-limits APIs, the audit results stay reproducible from the repository alone.
Historical published snapshot
| Month | Version | Open | Suppressed (justified) | Report |
|---|---|---|---|---|
| June 2026 | v4.0.7 | 0 | 28 | HTML |
For the full reference (suppression list with rationale, historical archive, tooling choices) see docs.aeroftp.app/security/continuous-audit.
