Security

1. What is encrypted and what isn't

TerminalSync is designed so that we can never access your content: nothing you sync passes through our servers. On top of that, the sensitive parts — secrets, credentials, memory and AI conversations — are encrypted locally on your Mac before leaving. Your project files are stored in your own cloud in their original format (so you can open them from Drive), under the exclusive control of your account.

• Algorithm: AES-256-GCM (Galois/Counter Mode), a standard authenticated symmetric cipher. Random 96-bit nonce per file.
• Master key: 256-bit, generated locally the first time you open the app. Stored on your Mac as a file protected by system permissions (only your user can read it) and wrapped with your secret phrase. It never leaves your devices unencrypted.
• Optional passphrase: the master key can be wrapped with your passphrase using Argon2id (m=19MiB, t=2, p=1). Without the passphrase, there is no unlock path.

2. Your cloud, not ours

Your files travel straight to the storage provider you pick: Google Drive, iCloud Drive, or Dropbox. TerminalSync does not operate storage servers. Content never passes through our infrastructure.

If you want to switch providers, just configure it in the app — everything is re-uploaded to the new destination.

3. Secrets vault

API keys, credentials, and sensitive secrets that live in .env files within synced folders can be marked as vault and get an additional encryption layer independent of the master key. Per-folder lock/unlock with one click.

4. Third-party API keys (Claude, OpenAI)

When you connect Claude Code or Codex, the API keys are stored in the OS Keychain, NEVER on plain disk or in JSON files. The configuration uses apiKeyHelper which reads them on-demand at call time.

5. Transport

All communication with our services uses TLS 1.3. HSTS preload active (max-age=63072000; includeSubDomains; preload). No downgrades, no cleartext.

6. HTTP headers

The site implements the following defensive headers:

• Strict Content-Security-Policy (own origin + explicitly allowed domains)
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy: camera, microphone, geolocation disabled
• X-Frame-Options: DENY
• X-Content-Type-Options: nosniff
• Strict-Transport-Security with preload

7. Vulnerability reporting

If you've found a vulnerability, email security@terminalsync.ai with details. We reply within 48 business hours.

We ask for responsible disclosure: give us ≥90 days to patch before making the detail public. Researchers are credited in the security advisory.

8. Transparency

This page describes what the app does today, not future promises. When the scope of encryption changes (for example, if we add further encryption layers), we update this page and note it in the changelog.

9. Contact

For security matters: security@terminalsync.ai. PGP key available upon request.