Reporting a vulnerability
To sicherheit@aszendra.com. You'll get an acknowledgement within 72 hours. Please don't publish before a fix is available — and do come back if nothing has happened after 90 days. There is no bounty, but there is a mention in the changelog if you want one.
Why you can trust an update
An automatic update is the most dangerous thing a program does: it replaces itself with something from the network. Whoever takes over that channel takes over every installation. So Aszendra checks three times, and each check catches something the others would let through.
1. TLS
Everything arrives over HTTPS from dl.aszendra.com. That
protects the route — but not against someone who gains access to the
storage the files sit in.
2. A signature over the directory
Which version is the newest, and where it lives, is stated in a small file. That file is signed with an Ed25519 key whose public half is baked into the program. The private half is not on the server, not in the repository and not in the build system — it is offline only. Someone who takes over the storage can swap files, but cannot produce a directory Aszendra will accept.
3. A checksum over the file
The signed directory states the SHA-256 checksum of every file. What was downloaded is held against it before anything is executed. If it doesn't match, the file is deleted and you get to see it — that is the case that looks like an attack, and it belongs on screen, not in a log.
No way back
Aszendra only accepts versions newer than the running one, and remembers the highest it has ever seen. A genuine, correctly signed directory from a year ago therefore cannot be replayed to bring back a version with a known hole.
What is still missing
Open: the operating system's signature
Aszendra is not yet signed with a developer certificate from Apple or for Windows. For the authenticity of an update that changes nothing — the three checks above run regardless. What is missing is the operating system's confirmation before the first install, which is why macOS and Windows warn on first launch. What those warnings mean →
How the program itself is separated
- Pages cannot reach the interface. Every navigation passes through one central decision; internal pages are reachable only from internal pages. A web page cannot navigate the interface window away and cannot see any of its interfaces.
- Messages are checked at the sender, not by channel name: whoever calls must come from the top frame of an internal page. Exactly three channels are open to web pages, and none of them changes anything.
- The password vault is a separate process with its own memory.
- Settings cannot be bent through the interface. Permissions, extension paths and the list of sites never to save for are unreachable from outside.