Last updated October 30, 2026.
Signed bundles
Every bundle carries a SHA-256 checksum and an RSA-SHA256 signature. The server checks both on upload; the plugin checks them again on the device before installing. A bundle that does not match is refused and the app keeps the bundle it has.
Transport
The plugin refuses an update URL that is not HTTPS.
Keys and tokens
API keys can be restricted to web origins, Android packages with their signing certificate, and iOS bundle ids. Access tokens are shown once, scoped to the apps you choose, and answer 404 outside that scope so other apps can’t be discovered.
Automatic rollback
A new bundle that never confirms its boot is reverted by the native layer after two cold starts.
Your part
- Keep the private signing key out of your repository.
- Store tokens in CI secrets, rotate them when someone leaves.
- Restrict production keys.
Reporting a problem
Report a security issue from the contact page, topic “A security report”. We reply and fix before we publish anything.