Security

ciciFTP carries your server passwords, and it was written with that in mind. Security is the default behaviour, not a setting. Everything below is on out of the box.

Your secrets

• Passwords are encrypted at rest: Windows DPAPI (only your account can decrypt) or, if you choose, a master password (PBKDF2-SHA256, 600,000 rounds → AES-256-GCM). Anything saved while the master password is locked is re-protected once you unlock.
• SSH private keys are encrypted on disk; a stolen file is unreadable even to OpenSSH. Key generation never puts the passphrase on a command line.
• In memory session and queue passwords are kept under CryptProtectMemory and decrypted only at the moment of use.
• Passwords never appear in logs, crash reports, the clipboard or export files (PASS ***, SAS signatures masked).

Server identity

• SSH host keys: on first contact the fingerprint is shown and nothing connects until you approve; afterwards it is pinned per host:port and any change stops the connection and asks again.
• TLS certificates (FTPS, WebDAV, S3, Azure, panel APIs): an invalid certificate is never accepted silently — reject / this session / always trust (pin). "Accept any certificate" exists only per site, with a warning.
• TLS 1.2 / 1.3 only; in FTP passive mode the server-supplied IP is ignored (no PASV bounce); FTPS never falls back to plaintext if AUTH TLS is refused. Sending a password over plain FTP/HTTP is flagged in the log.

No trust in server data

• File names are filtered for path traversal (../), Windows device names (NUL, CON) and invisible/bidirectional Unicode (name spoofing); local targets always stay under the folder you chose and never write through junctions/symlinks.
• Archive extraction (zip/tar) rejects absolute paths, .. and symlink entries. XML (WebDAV, panels) is parsed with DTDs disabled (no XXE). Response sizes are capped; recursion stops at 64 levels (a server showing a symlink loop cannot crash the app).
• Files with executable extensions (.exe .bat .ps1 .lnk …) ask before being opened by double-click.
• HTML preview opens in your browser inside a CSP sandbox: no scripts, forms or external resources.

Release integrity

• The update check verifies the ECDSA P-256 signature of version.json against an embedded public key; unsigned or mis-signed notices are ignored. The download link may only point to https://ciciftp.com. ciciFTP never downloads and installs by itself — you download in your browser (SmartScreen stays in the loop).
• SHA-256 checksums are published for every package (download). The server agent (ciciftp-agent.sh) install line verifies the script's checksum and refuses to run on mismatch.

Automation surface

The scripting language is a whitelist: no shell commands, no eval, no process launching — a shared script cannot execute code.

Audits

Three separate review rounds were done before release (attack-surface map, attack simulations against real servers, dependency scan); every finding was fixed and added to the automated tests (27 suites, 895 checks, run against real FTP/SFTP/WebDAV/S3/Azure servers).

Reporting a vulnerability

If you believe you found a security issue, please write to us first: security@kodhisar.com (/.well-known/security.txt). We answer within 72 hours and ask you to keep details private until a fix is released.