Security

Security

URSA connects only to servers you already control and stores as little as possible. Its full security posture is mapped to the OWASP Mobile Application Security Verification Standard (MASVS) in docs/security.mdx. This page is a short summary.

What URSA protects

• Credentials at rest. After login the session token and any explicit access headers are stored encrypted with AES-256-GCM (Tink) under a master key held in the Android Keystore. Your password and TOTP are never written to disk.
• Transport. All traffic uses TLS by default (OkHttp for the live connection, Ktor for status pages).
• Screen contents. FLAG_SECURE is set app-wide, so monitor data and server URLs stay out of screenshots, screen recordings, and the recents preview.
• Push surface. The push service is not exported, and push payloads are treated as untrusted input (parsed tolerantly, render-only).
• Deep links. Private routes contain a one-way server scope and local ID, never a URL, token, header, or credential, and resolve only saved records.
• Privacy. No analytics or telemetry. Normal traffic goes to your server and push distributor. A manual update check contacts only URSA's official GitHub release endpoint without an identifier and never downloads or installs an APK.

Deliberate trade-offs for self-hosting

• Self-signed certificates. Trusting one is opt-in per connection and clearly labelled. Only enable it for servers you control.
• Plain HTTP. Allowed so plain-HTTP self-hosted instances work. Prefer HTTPS.

These are documented, tracked items, not accidents. Optional biometric/device- credential lock is implemented; scoping global cleartext further remains tracked.

Reporting a vulnerability

Please report privately, not in public issues. See the Security Policy.