Rex takes security seriously. If you discover a security vulnerability, please follow responsible disclosure:

• GitHub Issues: For non-security bugs only
• Security Issues: Report privately via GitHub Security tab

1. Description: Clear explanation of the vulnerability
2. Impact: Potential security implications
3. Reproduction: Steps to reproduce the issue
4. Environment: Device, OS version, app version

• Acknowledgment: Within 48 hours
• Assessment: Within 1 week
• Fix: Depends on severity (critical issues prioritized)

• Private keys encrypted with AES-GCM using Android Keystore
• Non-exportable KEK with StrongBox when available
• Random DEK generation with secure zeroization

• TOFU (Trust On First Use) model
• SHA256 fingerprint pinning
• Strict host key checking by default

• Metadata-only logging with automatic redaction
• No sensitive data persistence in logs
• FLAG_SECURE on key and session screens

• Device credential unlock required
• Configurable session timeout (1-30 minutes)
• Optional clipboard with 60-second auto-clear

• Ed25519 key generation not yet implemented (placeholder)
• Full SSH key parsing implementation pending
• Device credential integration requires Android implementation

• Screenshots disabled on sensitive screens
• Clipboard copying disabled by default
• Host key verification enabled
• Cleartext traffic disabled
• App backup disabled

For general questions about Rex, please use GitHub Issues.