What protects your credentials, and what does not

CySecTek is developed and published by an individual, not by an incorporated software vendor. There is no company registration to point you at, and this page is not going to imply one.

The authoritative download is cysectek.com. Superseded releases are mirrored on GitHub. Anything offering CySecTek from another domain is not something we published, and the in-app updater will not install from one.

The installer is not code-signed. Windows SmartScreen shows a blue 'Windows protected your PC' screen for unsigned software it has not seen often, and you have to click 'More info' then 'Run anyway' to proceed. That is not a bug and not a false positive — it is Windows correctly telling you that nobody has vouched for this file.

A signing certificate requires a verified organisation or validated individual identity, and the certificate authorities that issue them are still being worked through. Until one is in place, every release will trip the same warning, and because SmartScreen reputation for unsigned software is tied to the file hash, it resets with each new release rather than improving over time.

In the meantime the honest mitigation is verification, not reassurance: check the SHA-256 of what you downloaded against the value published here before you run it. If the hashes do not match, do not run the file.

Every installer's SHA-256 is published on the download page and in the release manifest the app itself reads. Compare it against the file you downloaded before running it.

In PowerShell: Get-FileHash .\CySecTek_x.y.z_x64-setup.exe -Algorithm SHA256

The updater refuses plain HTTP outright, and refuses any host that is not cysectek.com — checked before the request is made, with the host parsed rather than pattern-matched, so a URL like https://cysectek.com.example.org does not get through.

A downloaded package is hashed and compared against the expected SHA-256 from the manifest. It is only handed to the installer if it matches; a mismatch is discarded.

The app password is mandatory and is not a screen lock. A 32-byte key is derived from it with Argon2id at OWASP's floor — 19 MiB of memory, two passes, one lane — and that key encrypts saved SSH, SFTP and RDP passwords with ChaCha20-Poly1305.

The password itself is never written to disk in any form. That is the point: a credential file copied off the machine is useless without it, including to a process running as your own Windows account, which is exactly what credential-stealing malware is.

It also means the password cannot be recovered. Lose it and the saved credentials are permanently unreadable. Everything else in the app keeps working.

RDP is the exception by necessity: Windows' own client takes its credential through the Credential Manager, so an RDP password is handed over that way rather than on a command line where any process could read it.

The first time you connect to a device its host key is recorded. On every reconnect the key is compared, and a connection presenting a different one is refused rather than offering a dialog that most people click through.

When a device has genuinely been rebuilt, a panel shows the stored fingerprint and the new one side by side so you can compare them against what the device itself reports before choosing to accept the change.

Choosing a private key stores the path to it, not the key. The file stays where it is, under whatever permissions you have already given it.

If the key has a passphrase and you ask for it to be saved, the passphrase is encrypted exactly as a password is — under the app password, with ChaCha20-Poly1305. If you do not save it, nothing is stored at all.

Keys are read in OpenSSH format, including encrypted ones. PuTTY's .ppk is not read directly; the app says so and names the PuTTYgen steps rather than failing with a parse error.

Session logging is opt-in and off until you turn it on. When it is on, a transcript is written per session, named for the host and the moment it opened.

Transcripts are encrypted with the same key as saved credentials and carry a .clog extension. This matters more than it sounds: a switch session routinely prints running-config, SNMP communities and pre-shared keys, and a plain-text log of that sitting in a folder is a credential file by another name.

Port Finder and Packet Capture need Npcap, the packet-capture driver from the Nmap project. Nothing else in the app requires it, and the app does not bundle, install or update it.

It is a kernel driver, so installing it is a real decision about what runs on your machine. Get it from npcap.com — the project's own site — rather than from a mirror.

The app runs as a normal user. Packet Capture is the exception: Windows only exposes raw capture to an elevated process, so seeing traffic requires running as administrator.

Everything else — scanning, SSH, file transfer, serial, the TFTP and DHCP servers — runs without elevation.

The application collects nothing about you and sends nothing about how you use it. There is no account, no licence check and no analytics library in the app.

It makes exactly three kinds of outbound request, all of them visible in what you are doing: a version check to cysectek.com; a public-IP lookup to api.ipify.org on the overview screen; and, when you press the button on the diagnostics screen, requests to Google's and Microsoft's connectivity endpoints, which is what testing internet reachability means.

Scan results, transcripts, credentials and exports stay on your machine. Nothing is uploaded.

Report security issues to info@cysectek.com. Include what you found, how to reproduce it and what you think the impact is. If you would like a reply encrypted, say so and we will arrange a key.

Please give a reasonable window to fix an issue before publishing it. In return: an acknowledgement that it was received, an honest assessment of severity, and credit in the release notes if you want it.

There is no bug bounty. This is one person's project and pretending otherwise would waste your time.

The application is Rust and TypeScript. Dependencies are pinned by lockfile so a build is reproducible, and updated deliberately rather than automatically.

The cryptography is not hand-rolled: Argon2id, ChaCha20-Poly1305 and the SSH implementation are established libraries, used as intended.

The installer is unsigned, as explained above.

There has been no third-party security audit and no penetration test. Nobody independent has reviewed this code, and this page does not imply otherwise.

TFTP and DHCP have no authentication or encryption. That is the protocols, not the implementation — run them on an isolated or trusted link and stop them afterwards.

Anything that decrypts your credentials runs on your machine as you. The app password protects credentials at rest against a copied file; it cannot protect against malware already running with your privileges while the vault is unlocked.

The app does not manage or rotate the credentials it stores. It keeps them; the policy around them is yours.