korax/korax-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Correct key-storage and platform claims: name only platforms that ship

Browse Source 
The README contradicted itself. Line 11's platform badge advertised
`Linux | macOS | Android | iOS` while line 87 of the same file said
`### macOS . iOS -- Coming soon`. Neither macOS nor iOS has ever shipped.

Three claims named iOS Keychain and macOS Keychain as active key stores:

- README "Key storage" said "On every platform ... (iOS Keychain, macOS
  Keychain, Android Keystore)" -- for a product whose platform list ends at
  Android.
- privacy-policy.md named `Android Keystore / iOS Keychain` for both
  credential storage and PGP private keys, which has it doubly wrong: it
  names a platform that does not ship and omits the two that do.

Verified against the implementation rather than reworded from memory.
mailcore uses the Rust `keyring` crate v3 with the `sync-secret-service`
feature (mailcore/Cargo.toml:58); the Flutter side uses
`flutter_secure_storage` ^10.0.0. So on the shipped platforms the stores
are Windows Credential Manager, Android Keystore, and the Secret Service
(libsecret) on Linux -- now what the docs say.

privacy-policy "last updated" moved to 30 September 2026.
This commit is contained in:
Eugen Kaparulin
2026-09-30 11:34:56 +03:00
parent 4a7a08244f
commit bf176c13df
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
README.md
View File

@@ -8,7 +8,7 @@
**PGP-First Email. Private by Default.**
[![License: PolyForm Noncommercial](https://img.shields.io/badge/license-PolyForm%20Noncommercial-blue)](LICENSE)
[![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20Android%20%7C%20iOS-lightgrey)]()
[![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20Windows%20%7C%20Android-lightgrey)]()
[![Status](https://img.shields.io/badge/status-Beta-orange)]()
</div>
@@ -187,7 +187,7 @@ The PGP/Sequoia integration, advanced privacy features, the proprietary Rust eng
## Security
**Key storage:** Private keys are never written to SQLite or disk in plaintext. On every platform, they are stored in the OS secure enclave (iOS Keychain, macOS Keychain, Android Keystore).
**Key storage:** Private keys are never written to SQLite or disk in plaintext. On the platforms that ship, they go to the OS credential store — Windows Credential Manager, Android Keystore, or the Secret Service (libsecret) on Linux.
## Notices