The app can reduce exposure, but Windows account security, encryption, backups, malware protection, project permissions, and safe handling remain essential.
Local-first data flow
Workspace records are stored in a local SQLite database. Current-version search, dashboards, billing calculations, and reporting queries run on the device. There is no Elevoire-operated synchronization service for workspace records in version 1.
Secrets do not belong in the briefcase
Passwords, API tokens, private keys, and database passwords are not modeled fields. SSH aliases and non-secret connection references may be stored, but the underlying keys and credentials remain in the systems you already use.
Do not place secrets in free-form notes, project descriptions, invoice notes, resource descriptions, or support messages.
Validated launch boundaries
The app limits web launches to HTTP/HTTPS addresses, checks local paths before opening them, restricts recognized argument placeholders, and rejects common shell control characters. A successful launch still transfers control to Windows or another application, whose policies and security then apply.
Portable, confidential copies
.dbcase backups include a versioned manifest, database byte length, and SHA-256 integrity value. Restore checks compatibility and integrity and creates a safety backup before replacement. JSON exports are readable business records and should be encrypted, access-controlled, and retained only as needed.
Protect the Windows environment
- Use Windows Hello or a strong account password and lock unattended devices.
- Enable supported device encryption and maintain current Windows security updates.
- Store backups in an access-controlled destination and test recovery periodically.
- Use least privilege for project folders, repositories, hosting panels, and client systems.
- Review notification content before allowing it on the lock screen.
- Keep independent source-control and business-continuity systems; the app is not their replacement.
Report vulnerabilities safely
Use the protected address on the Support page with the subject “Developer Briefcase security report.” Include affected version, impact, reproduction steps, and non-sensitive evidence. Do not access data you do not own, degrade services, send malware, publicly disclose an unresolved issue, or include live credentials or personal data.
Elevoire will attempt to acknowledge legitimate reports and assess them in good faith. No specific response time, bounty, or safe-harbor promise applies unless confirmed in writing.