Security
Built to be trusted with your databases.
- Credentials
- Database and SSH passwords are stored in the macOS Keychain, never in plain text. Connection exports can be encrypted with a passphrase.
- Encrypted connections
- Remote servers get verified TLS by default, including host-name checks. Every connection shows a badge for what is in effect, and turning verification off is a deliberate choice.
- SSH tunnels
- Host keys are pinned on first use and checked after, and agents such as 1Password and Secretive are supported so keys never touch disk.
- Production safeguards
- Mark a connection Production for a banner and confirmations. Read-only connections are enforced by the database where it supports it. No tool can stop every harmful statement, so use least-privilege database users for the strongest protection.
- Privacy
- No analytics and no telemetry. The app talks only to the servers you configure. Statements that look like passwords are kept out of history.
- Apple-notarized releases
- Releases are signed with our Developer ID and notarized by Apple. Each release publishes a software bill of materials and a license report.
- Reporting a problem
- Found a vulnerability? Write to [email protected] with “Security” in the subject. We acknowledge reports within two business days.