Skip to content

Security: VD171/VD-Backup

Security

SECURITY.md

Languages: English · العربية · Čeština · Deutsch · Español · فارسی · Français · हिन्दी · Bahasa Indonesia · Italiano · 日本語 · 한국어 · Nederlands · Polski · Português · Русский · Svenska · ไทย · Türkçe · Tiếng Việt · 中文


Security Policy

VDBackup runs as root and handles your data and (optionally) your credentials and encryption passphrases. We take security seriously.

Reporting a vulnerability

Include a clear description and, if possible, steps to reproduce. We will respond as soon as we can and credit you if you wish.

Scope notes

  • Credentials and passphrases are stored encrypted at rest and are never written in clear text. Backups are never tied to device-bound hardware keys (so they stay portable), which also means the passphrase is what protects an encrypted backup - choose a strong one.
  • The optional Google Drive companion app should always be hidden with HMA-OSS so it does not reveal root or an unlocked bootloader.
  • Restore runs as root, so every archive is checked before anything is written: a backup whose contents point outside their target (an absolute path or a .. component) is refused, and no file is extracted until the whole archive is cleared.
  • Every prebuilt binary and library is traceable to a pinned public upstream with a recorded SHA-256, and the manifest ships on-device, so the bundled payload can be audited and reproduced. See docs/BINARIES.md.

This documentation was generated with Claude (Anthropic) and is maintained by VD171. Corrections and improvements are welcome - see CONTRIBUTING.md.

There aren't any published security advisories