Local-first. By design.
Hosts and snippets live on your device, and private keys live in the OS keychain. Optional AI calls leave the device. Read the model below.
Bastion does not run a backend for your data. There is no account to create, no sync to a vendor cloud, no analytics pipeline.
Private SSH keys live in the platform keychain. The frontend never sees the key material; only the SSH service resolves a key ID to a key inside the keychain.
Version 1.1.0 checks latest.json on downloads.bastion.hexifytech.com. Checksums are in SHA256SUMS.txt on that host.
Where your data lives.
Every piece of state in Bastion is stored somewhere specific. None of it is on a server we operate.
| Data | Storage | Notes |
|---|---|---|
| Hosts, groups, tags, snippets | Local SQLite (bastion.db) | Never leaves the device. |
| Private SSH keys | OS keychain (Credential Manager / Keychain / Secret Service) | The interface does not receive the private bytes. |
| Passwords (entered at SSH prompt) | Memory only | Dropped on disconnect. Never written to disk. |
| Terminal scrollback | In-memory per session | Cleared when the session ends. |
| Application settings, themes | Local SQLite | Same database as hosts and snippets. No remote sync. |
| Crash reports, telemetry | No reporter found | A local telemetry flag is forced off. No sender was found in the source. |
- A key in a vendor cloud breach (there is no vendor cloud).
- Plaintext private keys at rest on your machine (they live in the OS keychain).
- Silent host-key rollover (mismatches hard-block until you confirm).
- Tampered updates. Version 1.1.0 checks a signed latest.json on downloads.bastion.hexifytech.com.
- Cross-device host-list leakage. Version 1.1.0 does not sync hosts.
- Protect against an attacker already logged in as you with the keychain unlocked. No local-only scheme can.
- Provide a managed cloud backup of your host list. You are the source of truth.
- Act as a cloud SSH broker. Bastion never proxies your sessions.
- Prevent a malicious app you willingly run from doing harm. Run code you trust.
Promises, not features.
These are product constraints that shape every other piece of the workspace.
There is no Bastion account backend. The host list is local SQLite. Version 1.1.0 does not sync hosts.
Private keys are stored in the platform keychain (Credential Manager / Keychain / Secret Service). The frontend never receives the key material.
Passwords entered at the SSH prompt are held in memory for the active connect and dropped on disconnect. They are never written to disk.
Version 1.1.0 embeds the updater public key and checks latest.json on downloads.bastion.hexifytech.com. SHA256SUMS.txt is on that same host.
Every connect compares the server-presented fingerprint against the trusted entry. A mismatch is a hard block with an explicit confirmation prompt.
Reporting a vulnerability
Please report security issues through the contact form. Messages are sent to hello@bastionterminal.com. We acknowledge within two business days and aim to ship a fix or mitigation within 30 days for critical issues.
For sensitive issues, request our PGP key from the address above and encrypt your report. Do not file public issues for undisclosed vulnerabilities.