Security

Found a hole? Tell us first.

If you've found a security problem in Loft, the gateway, the apps or this website, please write to hello@incremental.no before telling anyone else.

How to report

  • Describe what you found, how to reproduce it, and which version you tested.
  • Please don't open a public issue, and don't test against gateways that aren't yours.
  • Give us reasonable time to fix it before you publish.
  • The repository's SECURITY.md says the same, in case you found us there first.

How Loft is built

  • Apps only talk to a gateway they were paired with. The keys come in the pairing code, so there's no trusting the first connection blindly.
  • Your password goes only over a connection pinned to your gateway, and the gateway stores it encrypted with a key that is only on your device.
  • The gateway signs in to the NAS as you, so the NAS's own permissions apply. It uses SMB 3 with encryption by default.
  • In direct mode, the gateway limits sign-in attempts, because many NAS boxes don't.
  • The gateway never updates itself. Every release has a SHA-256 checksum.
  • Every change to the code is scanned for secrets before it's accepted.

What's encrypted on each route, and what we can't protect against: How it works.