Security and privacy

Pairing

• Each session has a random 128-bit id and a 256-bit secret from the operating system's cryptographic random generator. Both are only in the QR code (in the part after #, which browsers never send to a server or include in referrers).
• A code is valid for a few minutes (2–15, configurable) and for one phone only. Creating a new code ends the previous session and invalidates its secret and tokens.
• After scanning, the phone receives its own random access token. You then confirm the phone on your computer; both screens show the same 4-digit code so you can be sure you approve the right device. Until you do, the phone cannot transfer anything.
• Pairing attempts are rate-limited and secrets are compared in constant time.

The local service

• Fluxio's web service runs only while a session is open and listens on one private LAN address — never on all interfaces. It stops when the session ends or Fluxio closes.
• Requests from public (non-local) addresses are refused. The Host header must match the session address, which blocks DNS-rebinding attacks.
• The access token travels in the Authorization header, not in cookies, so other websites cannot make requests on your behalf (no CSRF). Cross-site and cross-origin requests are rejected.
• Strict security headers: Content-Security-Policy without inline scripts, no framing, no referrer, no content sniffing. Request sizes and request rates are limited.

Files

• Incoming files need your approval (unless you turn that off). Nothing is written before you accept.
• File names from the phone are cleaned: folder parts, .., reserved Windows names, control characters and right-to-left tricks are removed, so a file can never be written outside the chosen folder.
• Data is streamed to a hidden temporary file and only moved to its real name after the SHA-256 checksum matches. Interrupted or cancelled transfers leave no partial files behind.
• Existing files are never overwritten unless you choose “Replace”. System and program folders cannot be used as the download folder.
• Fluxio never opens or runs received files. Received files are marked as downloaded (Mark of the Web), so Windows warns before running a received program.
• The phone only sees names and sizes of files you chose to send — never paths or other folders on your computer.

Encryption — the honest part

Inside your local network, the connection between phone and computer uses HTTP. A trusted HTTPS connection to a local IP address would require installing a certificate on the phone; self-signed certificates cause security warnings, and Fluxio will not ask you to click through them.

What protects you: your Wi-Fi encryption (WPA2/WPA3) encrypts traffic over the air; sessions are short and bound to one approved phone; content is verified with SHA-256. What does not: someone who controls your network (for example on an untrusted public Wi-Fi) could observe or interfere with a transfer. Fluxio warns when Windows marks the network as Public. Use Fluxio on networks you trust.

Windows Firewall

The first time Fluxio listens, Windows asks whether to allow it. Allow it on private networks. If the network type changes later, Fluxio detects that the firewall blocks it and offers to add a rule that is limited to private networks, the local subnet and Fluxio's ports (this needs your administrator approval).

Privacy

• No account, no cloud, no telemetry, no analytics.
• The local history stores file names, sizes, dates, results and the phone's browser description — never contents or folder paths. You can delete it at any time.
• Logs stay on your computer for 7 days and contain no tokens, secrets, file contents or paths.
• On the phone, an optional history is kept only in that browser's local storage.
• This website uses no cookies and no analytics. The download page asks GitHub's public API for the latest release.

Reporting a problem

Please report security issues privately through GitHub's “Report a vulnerability” on the repository instead of a public issue.