TRUST THROUGH SPECIFIC EVIDENCE
What has been verified—and what has not.
SecureServe is Early Access software. This page documents concrete release checks and operational boundaries without claiming a certification or independent audit that has not occurred.
The universal macOS 0.1.1 PKG is signed with Apple Developer ID identities, notarized by Apple, stapled, accepted by Gatekeeper, and tested through install and upgrade.
Linux x86-64 and ARM64 archives have published SHA-256 values. Public downloads were retrieved again and compared with the release manifest.
The source passed Go race tests, vet, Staticcheck, Gosec, and govulncheck at the recorded release checkpoint, with no reachable vulnerability reported by that toolchain.
An encrypted off-host backup was restored in an isolated environment. Configuration, administrator authentication and MFA, state, TLS material, and the SFTP host key were checked before cleanup.
A controlled live subscription test covered checkout, webhook delivery, signed Pro license verification, cancellation, full refund, and post-cancellation entitlement removal.
Security-relevant product controls
- SFTP transport with an Ed25519 server host key
- Private per-user roots and rooted filesystem operations
- Bcrypt password hashing and SSH public-key authentication
- Administrator authenticator MFA with single-use recovery codes
- Authentication rate limiting, audit logging, quotas, and extension policies
- Administrator and user HTTPS endpoints bound to loopback by default
Important limitations
SecureServe has not completed an independent security audit or penetration test and is not presented as compliance-certified software. The default first-run certificate is self-signed. A trusted certificate, carefully configured firewall or reverse proxy, tested backups, monitoring, and an independent review are required before production internet exposure.
Safe evaluation recommendation
- Verify the download checksum.
- Start in a controlled local or private network.
- Change the generated administrator password and enable MFA.
- Create a limited test user and use non-sensitive files.
- Back up both
config.jsonand the completedata/directory.