Trust

Melta's rule is simple: never a relay, never hold your keys, never store your work. Your phone connects to your computers itself, over SSH. Melta's server holds your account and the little the app needs to list your computers and send notifications. This page says what that means, and what someone could and could not do if something went wrong.

No relay

Melta's server never connects to your computers and has no way to. Terminals, agent chats and files go straight between your phone and your computer over SSH.

Keys stay on your phone

When you add a computer, Melta makes a new Ed25519 key on the phone, using the phone's secure random number generator. The private key is saved in the iOS Keychain or Android Keystore and is never sent to Melta's server. A key you paste, its passphrase, or a password is stored the same way. Only the public key leaves the phone, inside the setup command you run on the computer. See Keys and security.

What the server keeps

• Your account: email address, name, a hashed password (or your Apple or Google account id) and your plan.
• Your computers: name, address, port and user name, and whether they sign in with a key or a password (never the key or password itself).
• Your preferences, and your phones' push tokens.
• Your notification history, and the chats and notes you choose to share.

The full list, field by field, is in What the server stores.

What it never sees

• SSH private keys, passphrases or passwords.
• Your terminals, agent conversations or files.

One exception: a notification carries a short line from your computer, such as the question a blocked agent asks, and the server keeps up to 300 characters of it with the pane's title. A chat or note you share is stored so its link works. See Notifications.

If our server were broken into

Someone with full access to Melta's server could read what it keeps: emails, names, password hashes, your computers' addresses and user names, notification text and shared pages. They could send notifications to your phones. An Allow, Deny or numbered answer on a notification is only typed into your computer after the phone reads that same question on your computer's screen.

They could not read your keys or passwords, sign in to your computers, or see your terminals and conversations.

They could change a saved computer's address so your phone connects somewhere else. The phone trusts a new address's host key on first use. With a key, the phone proves it holds the key without sending it, so nothing reusable leaves the phone. With a password, the phone would send that password to the new address. That is one reason to prefer keys.

If your phone is lost

• Melta has no app lock of its own. Anyone who can unlock your phone can open Melta and your computers.
• On each computer, remove the line ending in melta-iphone or melta-android from ~/.ssh/authorized_keys. From then on that key cannot sign in.
• If a computer signs in with a password, change that password.
• Reset your Melta password from the sign-in screen. A reset signs every other phone out of your account within 12 hours.

The client code

The code that does the trusted part on the phone is small: the native SSH module (libssh2 on iOS, sshj on Android), the code that makes Ed25519 keys and reads OpenSSH key files, and the code that stores keys and host keys in the Keychain or Keystore. We are preparing it for publication; this page will link to it.

Report a security problem

Email support@getmelta.app with the subject Security. Say what you found, how to reproduce it and which app version or page it affects. Please do not test against other people's accounts.