Threat Model

Honesty about a threat model is a stronger trust signal than claims of total security. A tool that can defend against everything is a tool making claims it cannot keep.

Threats VuAppStore protects against

Server-side breach of our infrastructure

Our production stack is Cloudflare Pages plus a small set of edge functions. If our Cloudflare account were compromised tomorrow, the attacker would gain access to static HTML and JavaScript files — the same files already public — and to the secret used by the blind signing endpoint. That secret can issue licenses, but it cannot decrypt user data, because no user data is on our servers.

Insider threat (us)

We cannot read the data inside VU applications, even if we wanted to. The encryption keys are derived on your device from your password, and the apps never transmit those keys. Spying on a specific user would require shipping a malicious application and getting your browser to load it — a change that anyone watching the public source could detect.

Mass surveillance and passive network observation

All traffic between your browser and our origins is TLS-encrypted, and the contents of licensing and authentication requests are themselves cryptographic constructs (blinded values, signed nonces). A passive observer learns that your browser talked to vuappstore.com at a particular moment; they do not learn what was inside.

Subpoena of our records

Our records do not contain decryptable user data, and our licensing records do not link licenses to people. A subpoena cannot compel us to produce what we do not have.

Threats VuAppStore partially protects against

Compromised endpoint (your device)

If malware controls your browser or operating system, it can read your data after you decrypt it. We cannot defend against this. We recommend running VU apps on a device you trust, with full-disk encryption, and keeping your operating system and browser updated.

Coerced disclosure

If someone forces you to unlock the app, they get your data. We cannot prevent this. Where individual apps offer duress passwords or decoy vaults, those features are documented in the app's own privacy disclosure.

Side-channel attacks

We use audited primitives (the WebCrypto API and well-known noble libraries) and we do not implement custom cryptographic constructions. Side-channel attacks against the browser, the operating system, or the underlying hardware are out of scope.

Browser zero-days

We rely on the browser's sandbox and crypto APIs. A browser zero-day that breaks the sandbox can defeat the protections that our code is built on. Keep your browser updated.

Threats VuAppStore does not protect against

Targeted attacks by nation-state actors

If a well-resourced state has decided to compromise specifically you, a web application is not the right tool. You need an air-gapped device, hardware-backed keys, threat-modelling beyond software, and probably a lawyer.

Loss of your password

We cannot recover your password. If you lose it, your encrypted data is gone. This is not a bug; it is the design. See /no-recovery.

Loss of your device with no backup

If your only device is lost or destroyed and you have no encrypted backup, your data is gone. We have no copy. Each VU app provides an export function for exactly this reason.

Metadata leakage in network calls

An on-path observer can see that your browser connected to vuappstore.com, even though they cannot see the contents. If you need to hide that fact as well, use Tor or a trusted VPN.

Social engineering

If someone convinces you to share your password, decryption key, or unlocked screen, the math does not help.

Legal compulsion of you

In some jurisdictions, you can be compelled to disclose your password. Our software cannot help you with this, and the legal frameworks vary considerably. Research the law of your jurisdiction before you set up the apps.

Cryptographic primitives in use

We have not yet undergone a formal end-to-end cryptographic audit of the VuAppStore storefront. We are honest about this. Apps making strong privacy claims without audits should be treated with calibrated skepticism — including ours.

Audit, verification, and disclosure

• Storefront source: github.com/vuappstore/vuappstore.
• Security disclosures: [email protected], see /developers/bug-bounty for the program.
• Public transparency log: /transparency.
• Warrant canary: /warrant-canary.