Security
A clipboard manager sits in the most sensitive data path on your machine. This is what ClipTrail promises today, what it doesn't yet, and how to report a problem.
Pre-release software. ClipTrail hasn't had an independent security audit yet.
The model in brief
| Where | Protection today |
|---|---|
| On your device | An encrypted SQLite database and encrypted image files in your user's data folder. The key is kept in your OS keychain (or the app's private storage on Android). |
| Between devices | Every clip and image is sealed with XChaCha20-Poly1305 under a key only your paired devices hold. Requests are authenticated with HMAC-SHA256; the device token itself never travels. |
| Pairing | X25519 key agreement over a one-time QR secret (10-minute, single-use, rate-limited) plus a 4-digit check code shown on both devices. |
| Keys | Windows Credential Manager, macOS Keychain; elsewhere (Linux, Android) a file readable only by your user or the app. |
| Secrets you copy | Password-manager copies are skipped. OTPs, API keys, JWTs, private keys and card numbers are masked, not indexed, never synced and deleted after 1 hour by default. |
| Logs | Clip content is never logged or put in error messages; only ids, kinds and sizes. |
The full explanation, including what an attacker on your network can and can't see, is in Privacy & security.
Reporting a vulnerability
Please don't open a public issue for security problems.
- Report privately through GitHub private vulnerability reporting.
- Read the repository's SECURITY.md for scope and severity.
- We aim to acknowledge reports within 72 hours.
Treated as critical
- Clip content reaching another party in plaintext, or reaching a device that wasn't paired.
- Secrets or clip bodies written to logs.
- Key material leaving the device it belongs to.
- Seeing someone else's history.