Security
Security and trust.
Bundvera handles commercially sensitive client projects. This page explains what it does to protect them, and what it doesn’t claim.
Local-first by design
Scanning, fingerprinting, Premiere project reading, verification and delivery-copy preparation all run on your computer. They don’t need an internet connection or an account, and Bundvera never uploads project files, file names or paths.
What can use the network
- Update checks, only if you turn them on. The app downloads a signed release file and shows a link; it never installs anything by itself. Not configured in current beta builds.
- Purchases and license recovery happen on this website, in your browser, when sales are open. License keys are then verified offline in the app.
- Diagnostics leave your computer only if you export the file and send it to us. They contain no file names or paths.
Treating files as untrusted
Manifests and project files can come from anyone, so Bundvera treats them as untrusted input.
- Manifests are validated against a strict schema with limits on size, entry count and nesting. Paths must be relative to the delivery folder: absolute paths, drive letters and
..segments are rejected. - The received folder is walked, not addressed. Bundvera lists what is actually in the folder and matches it to the manifest, so a hostile manifest can’t make it open files elsewhere on your computer.
- Symbolic links are never followed during a scan, and loops are detected.
- Premiere project files are opened read-only and decompressed with a size limit that stops decompression bombs. XML is read with limits on its structure; document type definitions and external entities aren’t processed. Nothing inside a project is executed.
- Delivery copies are written only to a new folder you choose. Bundvera never overwrites, moves or deletes your originals.
What a manifest proves, and what it doesn’t
Every manifest carries an integrity digest computed over its contents. It detects accidental damage and casual editing. It isn’t a digital signature: someone who can edit a manifest can also recompute its digest, and the manifest doesn’t prove who created it. If that matters, send the manifest, or the digest printed on the receipt, through a separate channel you trust.
Licenses
License keys are signed with Ed25519 and verified offline against public keys built into the app. There’s no activation server, so a network outage never stops a licensed user from checking a project.
Installers
Private beta builds aren’t yet signed with an Apple Developer ID or notarized by Apple, so macOS warns before opening them. Public releases will be signed and notarized, and each will list its SHA-256 checksum on the download page.
Certifications and audits
Bundvera has no security certifications, such as SOC 2 or ISO 27001, and hasn’t had an independent security audit. We describe what the software does instead.
Reporting a vulnerability
Email danilson.daveigaramos.pro@gmail.com with the subject “Bundvera security report”. Describe the problem and how to reproduce it. Please don’t include client media; a synthetic example is enough.