Security

ServerAlyzer connects your PC to servers over SSH, directly or through one jump host. The app has no backend, account, built-in telemetry or metric uploads to the publisher.

SSH trust before authentication

• The app displays the SHA-256 fingerprint of an unknown host key and requires your explicit confirmation before sending that server’s credentials. Verify the fingerprint through an independent, trusted channel.
• A key that differs from the saved identity blocks the connection. It is never accepted automatically and there is no shortcut to ignore a mismatch during connection.
• The jump host and target have independent credentials and identities. The first connection may require two confirmations, first for the jump host, then for the target. Route trust is associated with the jump host and the real target.

Bounded SSH configuration import

• Import reads .ssh/config only when requested. Included files must remain inside .ssh; links and includes outside that folder are not followed.
• Valid single-hop ProxyJump is supported in the base product. ProxyCommand, multiple hops and ambiguous or unsafe-to-resolve configurations are blocked, never silently converted into direct connections.
• Key suggestions inspect only the name and size of common key files. A key’s contents are read only to authenticate a connection configured to use it.

Credentials and local files

• SSH passwords and passphrases are stored in Windows Credential Manager for your account on this PC. Configuration files do not contain those secrets.
• The app stores only a private key’s path; it does not copy the file or include it in backups. Windows file permissions still protect it.
• Configuration, SSH trust and history are local data. Their protection also depends on the security of your Windows account and PC; encrypted backups do not mean the entire local database is encrypted.

Encrypted backups

• Backups include servers, routes, trusted host keys, notification and background settings, and saved passwords and passphrases. Private-key files and metric history are excluded.
• Content is protected with AES-256-GCM. The encryption key is derived from your chosen backup passphrase using PBKDF2-HMAC-SHA256 with 1,000,000 iterations. The technical header contains no server data.
• There is no recovery if you forget the passphrase. Files are saved only where you choose and never uploaded by the app. A synced folder is subject to the sync provider’s terms.
• A temporary copy in restore-journal allows an interrupted restore to be rolled back.

Read-only monitoring

• The command catalogue is fixed: CPU, memory, disk and uptime metrics, Docker container lists and systemd or launchd services.
• There is no arbitrary command execution, sudo, agent installation, or service start, stop and restart actions. Missing permissions produce an error or unavailable state, not privilege escalation.
• Remote output is untrusted input, with size and field limits, text validation and control-character sanitisation before display.

Local discovery only on request

• mDNS/DNS-SD discovery for _ssh._tcp starts only on explicit request. It does not scan ports or address ranges or connect to discovered devices.
• It stops when cancelled, when you leave the page or hide the window, after about 40 seconds without new results, and after at most 10 minutes. Results remain in memory and are discarded afterwards.
• Windows Firewall permission allows reception of mDNS responses. Adding a result still requires SSH identity confirmation.

Widget, notifications and diagnostics

• The widget runs in a separate process and reads a sanitised local summary. It cannot access SSH or credentials; the summary excludes addresses, usernames and host keys. Card content is passed to Windows on the PC.
• The app does not write log files. The widget component may emit local technical Windows event tracing, without server data or secrets.
• Microsoft Store reports and Windows diagnostics are handled by Microsoft under your settings and its policies. They are separate from app telemetry. The runFullTrust capability does not grant administrator rights.

Supported versions and vulnerability reports

• Security fixes target the latest published version and the main development branch. Older releases are not maintained in parallel.
• Report vulnerabilities privately through GitHub Security Advisories. Include impact, reproduction steps, version and environment. Do not publish exploitable details, credentials, private keys or personal data.
• Do not test infrastructure without permission. Disclosure should be coordinated, allowing time to investigate and fix the issue; reporter credit is optional.