Please do not open a public issue for vulnerabilities involving credential handling, SSH host verification, command execution, or tunnel isolation.

Report security issues privately through GitHub Security Advisories after the repository is published. Include affected versions, reproduction steps, and impact where possible.

• SSH, sudo, and private-key passwords are kept only for the active connection and are not persisted.
• VNC credentials are generated remotely and stored locally through Electron safeStorage when available.
• Remote VNC, noVNC, and Chromium debugging ports bind only to 127.0.0.1.
• Remote access is carried through the authenticated SSH connection.
• SSH host fingerprints are remembered and verified on later connections.