Security & disclosure
Found a vulnerability? Please report it privately to NorseHorse@norsehor.se, encrypted to the PGP key if you can. Give me a reasonable window to fix it before public disclosure and I'll credit you (or keep you anonymous — your call).
The model, in brief
PassPony is a local application. It has no backend, so there is no server to breach and no database of user secrets anywhere. What it protects, and how:
- Entry contents are encrypted to your keys (age or OpenPGP). Decryption happens on-device and decrypted text lives only in memory while you view it — never written to disk.
- Keys are stored using the operating system's data protection and, optionally, a passphrase. Cached passphrases are time-boxed and cleared automatically.
- Sync touches only the git remote you configure. The store is already encrypted before it leaves the device.
- Clipboard copies are local-only and set to expire.
Honest limits
No tool is magic. PassPony is explicit about what it does not protect:
- Metadata. Entry names, folder structure, and change timing are visible to your git host — a property of the password-store format, not a bug. Name entries accordingly.
- A compromised device. Malware, a malicious keyboard, or an attacker with your unlocked phone is out of scope; no on-device app can fully defend that.
- Your key hygiene. Weak passphrases and lost backups are risks only you can manage.
How the crypto is verified
Compatibility and correctness are enforced by an automated test suite: everything PassPony writes is decrypted by the real gpg and age binaries and compared byte-for-byte, and the reference pass/passage stores are the specification. The cryptographic cores are open source so the claims are checkable rather than trusted.
Reporting
Email NorseHorse@norsehor.se · key at /pgp · machine-readable policy at /.well-known/security.txt.