Mobile Sync Guide

Mobile Sync Guide

Mobile sync is intended to let a mobile device temporarily connect to the local desktop/server instance using a QR-based pairing flow.

This feature is still being tested and should not be considered stable yet.

This is a temporary feature as a mobile app is intended to replace it in the future.

Current Status

Mobile sync exists in the project, but its behavior still needs end-to-end verification.

Known current concern:

• The app now binds to 127.0.0.1 by default for safety.
• LAN/mobile sync may require explicitly enabling LAN access.
• QR links may fail if they point to the wrong network adapter or a non-reachable local IP.
• Mobile sessions are intentionally restricted and should not have full admin access.

Security Concerns

Mobile sync should be treated as a limited session, not a full desktop/admin session.

Mobile sessions should NOT be able to:

• Import recovery snapshots
• Reset recovery credentials
• Delete vault data
• Change privileged settings
• Run destructive/admin endpoints
• Access full-session-only API routes

LAN Access

By default, SeaViperCascade should only listen on localhost.

To allow mobile devices on the same network to connect, LAN binding may need to be enabled explicitly.

Expected behavior:

• Local desktop use: localhost-only
• Mobile sync use: explicit LAN opt-in
• QR code should use a reachable LAN IP
• Mobile pairing should be temporary and scoped

Needs Testing

• Correct LAN IP selection
• Pairing expiration
• Mobile session permissions
• Mobile copy/view flows
• Behavior when LAN binding is disabled
• Behavior across different network adapters

Known Issues

Mobile sync currently needs more testing.

The app may generate or expose a QR link that does not work correctly depending on the active network adapter or server binding mode.