Security & Responsible Disclosure

Email security@dfacto.ai with details and reproduction steps. Please do not open a public issue. We aim to acknowledge within 2 business days and will keep you updated until it is resolved. The full policy, with scope and timelines, lives in SECURITY.md in the repository.

The Rotor extension, the migration parser package, the release pipeline, and this website.

We will not pursue action against researchers who act in good faith, avoid privacy violations and service disruption, and give us reasonable time to remediate before public disclosure.

Rotor has no server, no account and no network code, which removes entire classes of risk by construction rather than by review. Secrets are encrypted at rest with Argon2id deriving a key and AES-256-GCM encrypting each item under a fresh 12-byte initialisation vector. Raw key bytes exist only in session memory. If Argon2id cannot be loaded, the vault refuses to open rather than degrading to a weaker key derivation.

Licence keys verify offline against a public key compiled into the extension; the signing key is held only where keys are issued, and no part of the extension can reach it.

Rotor is not audited. If an audit ever happens, the report will be linked here. We do not use the words unhackable or military-grade, and we do not claim reproducible builds — Google re-signs every extension on upload, so a store artifact is never bit-identical to a local build. We claim the narrower, true thing: the payload inside the published package is byte-identical to a build from the tagged commit.

Storing 2FA seeds in a browser is a real security downgrade compared with a separate hardware token. Rotor defends against credential stuffing from unrelated breaches. It does not defend against phishing, or against malware already running on your machine.