RULog inOpen driveDownload for Mac

Security

Private by construction.

No trackers in anything we ship, no passwords to leak, storage keys that expire in minutes, and bytes checked before they are used. How it works — and what we have not built yet.

trackers, in the product and on this site
0
a sign-in code lives
10 min
a storage credential lives
15 min
on every shard
SHA‑256

01Privacy

Zero trackers. Not one.

No analytics, no telemetry, no crash reporting — in the Mac app, in the web app, or on this website. In the product they were deleted from the code, not switched off. Fonts are served from our own domain, and a strict Content-Security-Policy stops pages from loading code from anywhere else.

  • Analytics
  • Telemetry
  • Crash reports
  • Session replay
  • Ad pixels
  • Third-party fonts
The web appContent-Security-Policy
default-src 'none';script-src 'self' 'nonce-…' 'wasm-unsafe-eval';style-src 'self' 'unsafe-inline';font-src 'self';img-src 'self' data: blob: <api> <storage>;media-src 'self' blob: <api> <storage>;connect-src 'self' <api> <storage> <live>;worker-src 'self' blob:;frame-src blob: <api> <storage>;object-src 'none';base-uri 'none';form-action 'none';frame-ancestors 'none'
This websiteContent-Security-Policy
default-src 'none';script-src 'self';style-src 'self' 'unsafe-inline';font-src 'self';img-src 'self' data:;media-src 'self';connect-src 'self';manifest-src 'self';object-src 'none';base-uri 'none';form-action 'none';frame-ancestors 'none'
NumbersShipped defaults
Trackers
0
Analytics and telemetry SDKs
0
Crash reporters
0
Fonts
self-hosted
Referrer-Policy
no-referrer
Framing by other sites
denied
HSTS
1 year, preload

Pages and files are delivered by Cloudflare, which hosts them. We don’t track you, and nothing we ship does.

02Sign-in

No passwords to leak. A code, then a session.

You sign in with a 6-digit code sent to your e‑mail. It works for 10 minutes and dies after 5 wrong guesses, and we keep only its SHA‑256 digest. The session that follows lasts an hour and renews itself with a token that works exactly once.

NumbersShipped defaults
Code
6 digits
Valid for
10 minutes
Wrong guesses allowed
5
Stored as
SHA‑256 digest
Session
60 minutes
Refresh token
single-use, rotating
Longest sign-in
30 days
Passwords
none

Presenting a refresh token a second time signs the account out everywhere.

03Storage access

Keys that expire in minutes. Each opens one drive.

Your Mac never holds a long-lived storage key. It trades your session for a credential that opens one drive for 15 minutes, and renews it before it runs out. Browsers never get a storage key at all — only short-lived signed links to the blocks they asked for.

NumbersShipped defaults
Credential lifetime
15 minutes
Renewed
5 minutes early
Scope
one drive
Storage keys in a browser
none
Where files live
Cloudflare R2
Layout
content-addressed shards
In transit
HTTPS only
At rest
encrypted by Cloudflare R2

04Integrity

Every byte, checked. Before it is used.

Files are stored as content-addressed shards, each named by its SHA‑256. Every shard is checked against its hash before it is served or cached, and the server re-checks every browser upload, block by block and as a whole, before the file appears. A mismatch is an error — never a plausible guess.

NumbersShipped defaults
Hash
SHA‑256
Checked
every shard
When
before serving or caching
On a mismatch
refused
Browser uploads
re-verified by the server
Identical data
stored once per drive

05The app

Signed, notarized, verified before it updates.

The Mac app is signed with our Developer ID and notarized by Apple. The installer refuses a Mac it cannot run on, and the updater installs a new version only when both its SHA‑256 and its signature check out.

zsh

spctl --assess -v "/Applications/goframe drive.app"

/Applications/goframe drive.app: accepted

source=Notarized Developer ID

codesign -dv "/Applications/goframe drive.app" 2>&1 | grep Team

TeamIdentifier=Y5U8RN35QX

NumbersShipped defaults
Signing
Developer ID
Team ID
Y5U8RN35QX
Notarization
Apple, stapled
Update feed
HTTPS only
Before install
SHA‑256 + Team ID
Local control socket
owner only (0600)

07Honestly

What we have not built yet.

Security pages usually list strengths. Here is what goframe drive does not do today, so you can decide with the whole picture.

  • End-to-end encryptionFiles are encrypted in transit, and at rest by Cloudflare R2 — but not on your device. There is no client-side or zero-knowledge encryption.
  • Single sign-onSign-in is by e‑mail code only: no SAML, no Google or Apple sign-in, no passkeys, no second factor.
  • Version history and trashDeletes are final. There is no trash, no restore and no backup to recover from.
  • Link passwords and expiryA public link cannot carry a password or an end date. Rotate or revoke it instead.
  • Audit logEach change is recorded with its author inside the drive, but there is no audit screen or export.
  • CertificationsNo SOC 2, ISO 27001 or similar certification today.

08Contact

Found something? Tell us.

Send security reports and questions to hello@goframe.dev. Tell us what you found and how to reproduce it.

hello@goframe.dev
Write to hello@goframe.dev