Security

Design

The interface is not trusted

The part of Scaffold that draws the screen runs in a web view and is treated as untrusted. It can only call a small set of narrow commands in the native part of the app, and those commands accept paths relative to your vaultonly.

File access is confined to the vault

For every request the native side:

• holds the approved vault folder(s) in memory,
• resolves the full real path of the request, and
• rejects .. segments, absolute paths, drive letters, UNC network paths and symbolic links that resolve outside the vault.

A vault folder becomes approved only through a native folder dialog that you operate, or from the recent-vaults list you approved earlier. The interface cannot grant itself access to another folder.

Content is sanitised

Rendered Markdown is sanitised before it reaches the page, and raw HTML inside notes is not executed. Exported websites carry a strict Content-Security-Policy and make no external requests.

Plugins are contained

The plugin system is off until you enable it. Plugins run with explicit, user-granted permissions, all off by default, and nothing is downloaded or executed automatically. See Plugins.

Your data is hard to lose

Writes are atomic and checked against the file's last known state. External changes are never overwritten; both versions are kept. Deleting moves to a restorable trash. See Vaults.

No data leaves your device

There is no account system, no server that stores notes, and no telemetry. There is therefore no Scaffold-run service to breach. The only request the app makes on its own is the optional daily update check, which you choose on first launch and which sends no personal data. See Privacy.

Reminders get a narrow door

The interface cannot use the notification system directly. It goes through a few small native commands that cap the text length, the number of scheduled alarms and how far ahead they reach. Reminders are worked out on your device; no push server is involved.

Verifying what you install

Each published file is listed on the download page with a SHA-256 checksum, and the page shows how to compute it. The Windows preview installer is not code-signed yet, so Windows SmartScreen warns about it. The Android APK is signed with Scaffold's own release key, but it does not come from the Play Store, so Android asks you to allow installs from that source and Play Protect may warn about an unknown developer. In both cases, checking the checksum is the way to know the file is the one that was published.

In-app updates (from 0.2.0)

• Nothing is checked until you answer "Check for updates automatically?" on first launch. The check talks only to this website, over HTTPS, and fetches one small static file with no account, device id or query string.
• Windows: the downloaded installer's signature is verified against a key built into the app before it runs.
• Android: the downloaded APK must match the published size and SHA-256 or it is deleted; Android then refuses any update not signed with Scaffold's release key, and shows its own confirmation.
• Only newer versions are offered, never older ones.

From 0.2.0 on, updates install from inside the app, so you only verify a file by hand the first time. Coming from 0.1.x, install 0.2.0 over your existing app; do not uninstall it first (on Android that deletes the notes stored in the app).

The Android app asks for four permissions: internet (the optional update check), notifications (only when you turn reminders on), run at startup (to set reminders up again after a restart) and install apps (to install updates). It has no storage, camera, microphone, contacts or location access. Its vaults live in its own app storage and are excluded from Android's cloud backup.

This website

• Static files only: no server code, no database, no forms.
• A strict Content-Security-Policy that allows only the site's own scripts, styles, images and fonts, plus other hardening headers.
• No third-party scripts, fonts, trackers or embeds, and no cookies.

Honest limits

• The source code is private, so it cannot be reviewed by outsiders, and there has been no independent security audit.
• Anyone with access to your device or your synced folder can read your notes: they are plain files.
• Scaffold does not encrypt your vault. Use disk encryption (for example BitLocker or Android's device encryption) if you need that.
• A plugin you trust with vault:write or network can do what those permissions allow.

Reporting a problem

There is no public security contact configured yet. See the contact page for the current state. Please do not post exploitable details in public places.