Please report vulnerabilities privately through GitHub: Security ▸ Report a vulnerability on this repository. Do not open a public issue for them.
| Area | Protection |
|---|---|
| SSH server identity | Keys are checked against ~/.ssh/known_hosts. A new server shows its SHA-256 fingerprint and is trusted only after you confirm that exact fingerprint. A changed key is refused. |
| Passwords and key passphrases | Kept in the system keychain (Windows Credential Manager, Secret Service on Linux), never in the database, backups or logs. |
| The library database | Encrypted (since 0.1.6): connections (name, host, user, key path, serial settings), your commands (name, template, purpose, notes, tags, parameters) and the collected log (templates and lines) are sealed with AES-256-GCM; lookups use keyed hashes (HMAC-SHA256), not the values. The key is random and kept in the system keychain; where there is none, it comes from a master password (Argon2id). A copied database file cannot be read without it. The first start of 0.1.6 encrypts an existing library (and its cmdex.db.bak-v1 copy) and rewrites the files so the plain values are gone from the disk. The starter commands' database holds nothing private and is not encrypted. |
| Collected command lines | Secrets are masked before anything is stored: passwords in options, user:pass@ and token-in-URL, curl -u, Authorization, cookies, net use, docker login -p, ConvertTo-SecureString, cloud CLI keys, and well-known token shapes (GitHub, GitLab, Slack, AWS, OpenAI-style, JWT). Lines collected by older versions are re-masked once at start. Add your own secret options under Collected ▸ rules. |
| Running commands | Cmdex never runs a command by itself: ▶ pastes exactly one line into the terminal and you press Enter (since 0.1.6). Commands are labelled by risk: Warning (changes the system) and Critical (may delete data or cut service: recursive delete, format, restart, firewall off, wiping a device configuration). The label is the higher of the level a command declares and the one Cmdex detects in its text, so imported, collected and typed commands are labelled too. A command holding line breaks, terminal escapes or invisible/direction-changing Unicode ("Trojan Source") is refused everywhere: on save, on pack and backup import, and on paste. |
| Screen capture | On Windows 10 2004+, Cmdex's window is excluded from screenshots, screen recordings, remote viewing and screen sharing (shield button in the top bar, on by default; always on while the secure keypad is open). |
| Keyloggers | Passwords, passphrases and secrets for sudo/Password: prompts are entered on an on-screen keypad whose keys move after every click: no keystrokes to log, no click positions worth logging. The physical keyboard is ignored there. |
| Terminal output | Links printed by a remote session (OSC 8) open only if they are http(s), only in the system browser, and only after you confirm. Output is never stored. |
| The window | Only Cmdex's own page can reach its functions; dropping files or links on the window does not navigate it. No network port is opened. |
| Help lookup | Never runs an unknown program: it reads man, PowerShell Get-Help, and /? only for console tools in Windows' System32, excluding a list of programs that act at once. |
| Imported files | Backups and packs are validated; a .db file is read from a copy with trusted_schema off. An imported command is always yours, never shown as a starter command: it cannot hide a starter command behind one of its own, and a copy of a starter command keeps that link only when it runs the same line, never asking less before running. Exported files are readable by their owner only. |
| Clearing the collected log | Deleted lines are erased from the disk (the database file is rewritten, its journal emptied), in the database and in the copy made when upgrading to 0.1.3 (cmdex.db.bak-v1). That copy is readable by its owner only and gets the same secret masking as the database. |
| Starter commands | Built at start from the packs inside the program into a separate, read-only database; checked like any command. What you change lives in your own database, which updates never rewrite. |
| Updates | Downloaded from this repository's releases over HTTPS and installed only when the SHA-256 matches the published SHA256SUMS.txt. |
| Tool packs | Built into the program (nothing downloaded). Finding a program only looks at file names in the folders of PATH; Cmdex never runs, reads or asks about it. A pack joins the library only when you turn it on. |
| Folder map (Work ▸ Map) | Reads names, sizes and dates only, never file contents, and only four layers at a time (the centre and three below); links and junctions are listed, never followed. File actions start only when you choose them and stay inside the folder on the map: they never touch that folder itself or system folders (Windows, Program Files, ProgramData, a drive's root; on Linux anything outside your home folder, /tmp and mounted drives). Deleting only moves to the system trash (the black hole): on Windows only on fixed drives, where the Recycle Bin exists; on Linux only on the same drive as your home trash; elsewhere Cmdex refuses rather than delete for good. Opening a file that runs as a program (.exe, .bat, .ps1, .jar, executable files…) asks first. Commands for a file are pasted, never run. Several files can be thrown in at once, after one confirmation; each still goes to the trash under the same rules. Paths on the map are not collected; only the folder the map showed last is kept, encrypted, to open there again (and it is left out of backups). |
| Notes (the chat bubble) | Notes open in a window of their own: a second Cmdex process started by Cmdex, tied to it by the anonymous pipes of its standard input and output (no port, no socket), closed with it, and closing at once when started by hand. It never opens the database: Cmdex answers only the notes' own calls (list, add, edit, delete, images, show a pinned file on the map) and refuses anything else. It follows the screen-capture protection setting like the main window. Text, the file or folder a note is pinned to, and images are encrypted in the database like your commands. A note is plain text with light markup that Cmdex draws itself, never HTML, so a note (or an imported backup) cannot run anything in the window; links open only if they are http(s), in the system browser, after you confirm. Images must really be PNG, JPEG, GIF or WebP (checked from their content; SVG, which can hold scripts, is refused), at most 8 MB; large photos are scaled down before saving. Commands and scripts in notes are coloured for reading and can only be copied: nothing in a note pastes into a terminal or runs. Notes are not collected or sent anywhere. |
| Terminal copy and paste | Pasting several lines asks first and shows them: most shells run each line as soon as it arrives. Ctrl+C copies only when text is selected, so it still interrupts a running command otherwise. |
| Starting at sign-in (Settings) | Off until you turn it on, for your account only (no administrator rights): the quoted path of the installed Cmdex under the HKCU Run key on Windows (removed on uninstall), ~/.config/autostart/cmdex.desktop (readable by you only) on Linux. A development build refuses, so a temporary program is never registered. |
cmdex in a terminal (Windows) |
The installer adds Cmdex's folder at the end of PATH (an option, on by default), so it never shadows a command you already have; uninstalling gives PATH back exactly as it was. cmdex.com, next to Cmdex.exe, starts Cmdex.exe from its own folder only, never through PATH, and passes your options unchanged; passwords are still asked, never taken from the command line. |
| Masked log (terminal tab ▸ Masked log) | The lines a terminal shows are kept in memory only, for the life of its tab, and never written anywhere; closing the tab erases them. A masked copy (secrets as ••••••, IPs, MACs, serial numbers, user and host names as stable names such as IP-1) is shown in a separate window, a second Cmdex process started by Cmdex. It receives only masked text, over the anonymous pipes of its standard input and output (no port, no socket: no other program can connect), never opens the database, and closes at once when started by hand. That window is not protected from screen capture, on purpose: share it instead of the main window. The real values behind the names are shown only in the main window, after you ask. Rules are declarative (a text, the word after a keyword, an RE2 pattern): they describe text, never run anything. They are encrypted in the database (a rule may be the secret itself) and travel in clear inside JSON backups, like notes. Full-screen programs (vim, top, less) are not logged. |
tools/devserve (development only) |
Listens on loopback only; every call needs a per-run token, the exact Host, and a JSON body (no cross-site requests, no DNS rebinding). |
- Telnet is unencrypted by design; use it only on trusted networks.
- Release files are not code-signed yet, so their integrity rests on this GitHub repository (and Windows SmartScreen may warn on first install).
- Encryption protects the database file (a lost disk, a copied file, a leaked backup of the folder), not against a program running as you, which can ask the keychain as Cmdex does.
- You choose how a JSON backup is kept (since 0.2.1). With a password it is encrypted (AES-256-GCM, key from the password with Argon2id) and opens on any computer only with that password; a forgotten password cannot be recovered. Without one it holds your library in clear (readable by your account only): keep it as safe as the library itself. Passwords are typed on the secure keypad, or in the terminal for
cmdex --export … --password, never on the command line. - Interface settings (language, theme, filters) and the names of programs you asked about are not encrypted.
- JSON backups without a password include your notes and their images in clear, like the rest of the library.
- Going back to 0.1.5 or older after 0.1.6 is not supported: those versions cannot read the encrypted values.
- Correction (2026-10-14): in 0.1.5 and earlier, ▶ Run pastes a command and presses Enter at once, whatever its safety level: "ask before running" and "copy only" are stored but not enforced (earlier versions of this file and of the 0.1.4/0.1.5 release notes said otherwise). Update to 0.1.6 or later, where ▶ only pastes.
- The folder map's file actions act at once after you choose them (rename, new folder) or after one confirmation (the black hole). Restore a deleted file from the system trash.
- Screen-capture protection covers the windows open when Cmdex starts; the system's own Open/Save file dialogs are separate windows and are not hidden from capture.
- The masked log is masked by patterns, which is never complete: a secret no rule describes stays visible. Check the shared window before you share it, and add a rule ("Mask this too") for what was missed. A JSON backup without a password holds your masking rules in clear.
- Risk labels come from patterns: a dangerous command written in an unusual way may not be labelled. Read a command before pressing Enter.