Security
In short: your access keys stay on your machine, encrypted, and your storage traffic goes straight from your machine to the endpoints you configure. There is no server of ours in the middle.
Your credentials
Connection profiles are stored encrypted on disk, in your user configuration directory. They are never transmitted to us, and no part of a profile appears in usage analytics — see the privacy page.
Your data
Listings, uploads, downloads and previews are direct requests from the app to the S3 endpoint you entered, signed with your own credentials. Nothing is relayed, cached or copied anywhere else. The local search index is built on your machine and stays there.
What else the app contacts
api.lemonsqueezy.com— checking that a licence is valid.eu.i.posthog.com— usage analytics, which you can turn off.github.com— looking for a new version, and downloading it.www.google.comandwww.cloudflare.com— reading the date they return, to notice a clock that has been set back to extend a licence.1.1.1.1anddns.google— resolving the licence server when the system resolver returns nothing.
Updates
Releases are published on GitHub and signed. The app verifies that signature before installing an update, so a tampered download is refused.
Reporting a vulnerability
Open an issue on GitHub saying that you have found a security problem, without the details. We will answer and agree on a private channel before you share anything exploitable.