AlpenSync is a local Android client. It talks only to Proton hosts, stores session material in the Android Keystore, and does not run a backend.
Do not open a public issue for a security bug.
Use a private GitHub security advisory:
https://github.com/WFT345/AlpenSync/security/advisories/new
Include:
- What you found, in plain language
- Affected version or commit
- Steps to reproduce
- What an attacker would need (physical phone, another app, network, GitHub)
We will acknowledge the report and say whether we can reproduce it.
- Theft or export of Proton session tokens or mailbox key material
- Bypass of the Keystore wrap, or tokens landing in AccountManager plaintext
- Contacts from other accounts on the device being read or written
- WebView human-verification escaping
verify.proton.me - Secrets committed to this repository
- Privilege issues in the exported authenticator or sync adapter
- Contacts sit decrypted in Android's Contacts provider after a successful sync. That is how the stock dialer sees them.
- The unofficial Proton API can change or break. That is a reliability issue, not a reportable vulnerability by itself.
- The source is public. Design notes in comments are not secrets.
Release APKs on GitHub Releases are signed with the AlpenSync developer key. The signing certificate SHA-256 digest is:
8d2781dc40ad1b55a0ea9bf79f6232bfe8a53b791d32361c8d8fa467b8f578ef
Check it with apksigner verify --print-certs. An APK with any other
signer is not ours.
Release APKs are minified. No signing key material is in this repository. Do not send private keys or Proton passwords in a report.