SECURITY

Languages: English | العربية | Čeština | Deutsch | Español | فارسی | Français | हिन्दी | Bahasa Indonesia | Italiano | 日本語 | 한국어 | Nederlands | Polski | Português | Русский | Svenska | ไทย | Türkçe | Tiếng Việt | 中文

---

Security Policy

VDBackup runs as root and handles your data and (optionally) your credentials and encryption passphrases. We take security seriously.

Reporting a vulnerability

• Site: https://vd171.ru
• Site: https://vd.priv8.ru
• Issues: https://github.com/VD171/VD-Backup/issues (non-security reports only)
• GitHub: @VD171
• XDA-Developers: @VD171
• XDA thread: https://xdaforums.com/t/VD-Backup.4807267/
• Telegram: @VD_Priv8
• Telegram: @Priv8_VD
• Discord: @VD.Priv8
• E-mail: vd.priv8@pm.me

Include a clear description and, if possible, steps to reproduce. We will respond as soon as we can and credit you if you wish.

Scope notes

• Credentials and passphrases are stored encrypted at rest and are never written in clear text. Backups are never tied to device-bound hardware keys (so they stay portable), which also means the passphrase is what protects an encrypted backup - choose a strong one.
• The optional Google Drive companion app should always be hidden with HMA-OSS so it does not reveal root or an unlocked bootloader.
• Restore runs as root, so every archive is checked before anything is written: a backup whose contents point outside their target (an absolute path or a .. component) is refused, and no file is extracted until the whole archive is cleared.
• Every prebuilt binary and library is traceable to a pinned public upstream with a recorded SHA-256, and the manifest ships on-device, so the bundled payload can be audited and reproduced. See docs/BINARIES.md.

This documentation was generated with Claude (Anthropic) and is maintained by VD171. Corrections and improvements are welcome - see CONTRIBUTING.md.