Please report suspected vulnerabilities privately through GitHub's Report a vulnerability security-advisory flow. Do not open a public issue containing credentials, private object URLs, logs, or reproduction data from a real storage account.
Include the affected version, expected behavior, observed behavior, and a minimal fictional reproduction when possible.
Murdawk Uplink delegates DigitalOcean Spaces authentication to rclone. Credentials remain in the user's local rclone configuration, commonly:
%APPDATA%\rclone\rclone.conf
The app persists non-secret connection metadata such as the rclone profile name, Space name, endpoint, and display name. It must not persist raw access keys or secret keys in application settings, job records, logs, manifests, or this repository.
Never commit:
- DigitalOcean access keys, API tokens, or secret keys
rclone.conf,s3cmd.ini, or.envfiles- exported connection packages
- local event manifests or media inventories
- run logs, private object URLs, or personal filesystem paths
Rotate a credential immediately if it appears in a screenshot, log, issue, chat, or commit.
Connection exports omit credentials and navigation history by default. Including credentials requires an explicit warning acknowledgement and a password of at least 12 characters. Key-bearing packages use scrypt and AES-256-GCM; an incorrect password or modified package is rejected before profile creation.
There is no password or key recovery. Send a package and its password through separate channels. Treat every exported package as private, even when it does not contain credentials.
Automation binds only to 127.0.0.1 and requires a revocable bearer key protected with Electron safeStorage. API keys and MCP configuration values are shown once and cannot be revealed later.
The local API and MCP adapter allow browsing, activity reads, queue reads, and queue preparation. They do not expose credentials, start real uploads, or provide remote delete, move, rename, or connection-export operations.
Downloads and previews use read-only rclone operations. Private previews are copied into an app-owned bounded cache, and the renderer never receives Spaces credentials. Durable logs are local, bounded, and credential-redacted, but should still be treated as private diagnostic material.
Transfer completion requires verification. A reported rclone progress value of 100 percent is not by itself a successful result.
The opt-in 0.2.0 service binds to loopback behind an explicitly configured HTTPS proxy. Named team keys are stored as SHA-256 hashes and scoped by operation, connection, remote prefix, source root and record ownership. Live upload and folder grants require local owner confirmation. Public callers cannot create keys or approve their own jobs. Local owner commands use a protected socket and separate owner credential.
Remote MCP supports PKCE OAuth with exact redirect registration, resource binding, hashed grants, expiring access tokens and rotating refresh tokens. Parent-key revocation invalidates OAuth access. MCP access tokens are accepted only at the MCP resource.
Source traversal, symlinks outside approved roots and credential-like paths are blocked. Remote-client media uses key-owned resumable staging with declared sizes, SHA-256 verification, quotas and a disk reserve. Frozen upload manifests, immutable-copy semantics, fresh pre-checks and final remote verification protect queued destinations. Interrupted jobs require a resume check; manual pauses remain held.
Private service state, named-key exports, OAuth data and staging must remain outside git and public artifacts. Audit records exclude headers, request bodies, credentials, host paths and subprocess output. Desktop service keys may persist only with protected storage; plaintext Linux storage is rejected. See service setup.