Security

DeckTerm holds the keys to your servers, so it is built to keep them on your iPhone and to notice when a server isn't the one you trusted.

Passwords and keys

Passwords and your private key are stored in the iOS Keychain with a this-device-only setting. They are not synced to iCloud Keychain, are not restored to another phone, and are never written to DeckTerm's backup files. Everything else (devices, settings, snippets) lives in the app's own storage on the phone.

Host key pinning

The first time you connect to a server, DeckTerm pins its host key (trust on first use). The key is shown as a SHA256 fingerprint, the same form ssh-keygen -lf prints, so you can compare it with the server.

If a server later presents a different key, DeckTerm refuses the connection and warns you, showing the new fingerprint. A changed key can mean the server was reinstalled, or that someone is intercepting the connection. Once you have checked the new key, you can forget the old pin from the device's edit form and connect again.

Network traffic

DeckTerm has no accounts, analytics, telemetry, ads or servers of its own. The only network traffic it creates is:

• the SSH connections you start, made directly from your phone to your servers, and
• App Store purchases for tips, handled by Apple.

The local network permission is used only to reach SSH servers on your network.

Built on open source

DeckTerm's SSH and cryptography come from widely used open-source libraries, including SwiftNIO SSH and Swift Crypto. The full list is on the licenses page.

Reporting a vulnerability

If you find a security issue in DeckTerm or this website, please email deckterm@cobanov.dev with the details and steps to reproduce. We aim to reply within a few days, and ask that you give us a reasonable chance to fix the issue before sharing it publicly.

A machine-readable contact is published at /.well-known/security.txt.