Security and Data Storage
S3 Manager stores all data on your device. No credentials, account metadata, or settings are sent to any first-party server.
Where your data lives
Section titled “Where your data lives”| What | Mechanism | Location |
|---|---|---|
| Secret access keys | Electron safeStorage (OS credential store) — ciphertext stored in SQLite | s3manager.db in the app data directory (see below) |
| Account metadata | SQLite (accounts table) | s3manager.db |
| App settings | SQLite (app_settings table) | s3manager.db |
Secret access keys
Section titled “Secret access keys”Secret access keys are encrypted with Electron safeStorage before being written to disk. safeStorage delegates to the operating-system credential facility:
| Platform | Backing store |
|---|---|
| macOS | Keychain Services |
| Windows | DPAPI (Data Protection API) |
| Linux | libsecret / KWallet (saving is refused if unavailable — no plaintext fallback) |
The ciphertext blob is stored in the account_secrets table of the local SQLite database. The plaintext key is never written to disk unencrypted. If safeStorage is unavailable on a given system, S3 Manager refuses to save the secret and raises an error.
SQLite database location
Section titled “SQLite database location”The database file is named s3manager.db and lives in Electron’s userData directory for the app:
| Platform | Path |
|---|---|
| macOS | ~/Library/Application Support/s3manager/s3manager.db |
| Windows | %APPDATA%\s3manager\s3manager.db |
| Linux | ~/.config/s3manager/s3manager.db |
The database contains three tables: accounts (label, provider, region, endpoint, access key ID), account_secrets (encrypted secret key ciphertext), and app_settings (key/value pairs for preferences).
No telemetry
Section titled “No telemetry”S3 Manager makes no network requests to any NoiX or third-party analytics endpoint. The only outbound connections it initiates are to your configured S3 endpoints and, if you opt in, to GitHub Releases to check for updates.
Account export security
Section titled “Account export security”When you export accounts (Accounts and Providers), the export file is always a base64-encoded envelope. Security depends on whether you set a password:
| Mode | Encryption | Key derivation |
|---|---|---|
| No password | None — JSON payload encoded as base64 | — |
| Password set | AES-256-GCM | scrypt (N=32768, r=8, p=1) with a random 16-byte salt |
When a password is set, the payload is encrypted with AES-256-GCM. The scrypt parameters are stored in the envelope alongside the random salt, IV, and GCM authentication tag. Decryption will fail if the password is wrong or the file is corrupted (authentication tag mismatch).
Vulnerability reporting
Section titled “Vulnerability reporting”Only the latest released version of S3 Manager receives security fixes.
Do not report security vulnerabilities through public GitHub issues.
To report a vulnerability privately:
- Go to the Security tab of the repository.
- Click Report a vulnerability and fill in the details.
If you cannot use private reporting, email the maintainer at ich@dginx.de.
Include where possible: a description of the vulnerability and its impact, steps to reproduce or a proof of concept, and the affected version and operating system.
Acknowledgement target: within 5 business days. Once a fix is released, reporters are credited in the release notes unless they prefer anonymity.
Reports are especially welcome for: credential handling, IPC boundaries between the main and renderer processes, presigned-URL generation, and the auto-update/release pipeline.