Security
How builds reach your Mac, where the apps keep secrets, and what they don't protect against. Everything here describes the current alpha builds.
Builds and updates
- macOS releases are signed with the AMYGDAL d.o.o. Sarajevo Developer ID, with the hardened runtime, and notarized by Apple.
- Every build is a public GitHub release with a
.sha256file. The launcher and the install script check each download against it, and a mismatch stops the install. - Archives are unpacked into a staging folder and moved into place in one step, so a failed or cancelled install leaves nothing behind. Entries with absolute paths,
..or links that point outside the install folder stop the install. - The public releases need no sign-in. If you point the launcher at a private repository, its GitHub token goes into the macOS Keychain, never into a file or a log.
The FerrumEnv vault
FerrumEnv keeps your projects' environment variables behind a master password and shares them encrypted.
- Key derivation
- Argon2id from your master password and a random 16-byte salt: 64 MiB of memory, 3 iterations, 1 lane, giving a 256-bit key. The parameters are stored with the vault, so they can be raised later, and are bounds-checked so a tampered file can't make unlocking eat memory.
- Encryption
- XChaCha20-Poly1305 with a fresh random 24-byte nonce on every save. The file header (format, version, key-derivation settings, salt, cipher) is authenticated too, so any change to it or to the ciphertext fails to decrypt.
- On disk
- ~/.ferrum/env/vault.json. Only the header is readable, not even project names. Saves are atomic (temp file, fsync, rename), mode 0600 in a 0700 folder, and the previous file is kept as an encrypted backup.
- Locking
- The master password is asked on every start. The vault locks after 30 minutes without activity (5, 15, 30 or 60 in Settings) or at once with ⌘L, and locking drops the decrypted data and the session key.
- Clipboard
- A copied value is cleared from the clipboard after 30 seconds if it's still there, and at once when the vault locks.
- In memory
- Variables, share keys, the session key and decrypted buffers are wiped when dropped, and values never appear in logs or debug output.
Sharing between developers
Each project has a share key: 256 random bits shown as fek1_… with a checksum, so typos and truncated pastes are rejected, and a short fingerprint to compare out loud. Bundles of environments are sealed with XChaCha20-Poly1305 under that key, with the project name authenticated. The key itself is never in a bundle.
Anyone with the share key can read and create bundles for that project: exchange it once, out of band, and rotate it to cut someone off from future bundles.
Limits, honestly
- Wiping memory is best effort: some copies (text fields, text layout) are freed but not zeroed, and swap and core dumps aren't prevented.
- Clipboard managers may keep a copy of a value while it's on the clipboard, and exported .env files are plain text.
- Malware running as your user (keyloggers, memory readers) is out of scope.
- There is no recovery: a forgotten master password means the data is gone.
Secrets in the other apps
- FerrumAPI stores collections, environments and their secrets in a local SQLite file and never logs them. Keychain storage isn't built yet. Its mock server and webhook inspector listen on
127.0.0.1only. - Ferrum Editor's AI agent sessions take API keys through per-agent environment variables, masked in the panel and never logged.
- Ferrum Editor's CI page reuses a GitHub token you already have (FerrumGIT's Keychain entry or the GitHub CLI), or one you paste.
No telemetry
The apps contain no analytics or telemetry. They connect to what you use them with: GitHub for releases and the CI page, and your own APIs, databases and container engine. This website sets no cookies and runs no analytics; see Privacy.
Report a problem
Found a security issue? Reach the team through amygdal.com.
Install Ferrum Launcher
One free download for Apple Silicon Macs. The launcher installs and updates every app.