Security

RunBackHome holds a family's pictures. This page says what isn't done yet and how to tell us when something is wrong.

What isn't done yet

• No outside tester has checked RunBackHome. Matt is putting together a test team to try to break it, and we'll publish their report once what they find is fixed.
• Reaching your pictures from away from home doesn't meet our promise yet: nothing leaves your machine unless you've trusted where it's going.
• It isn't open to other families yet. That waits until security is signed off.

Checking a release

Every release will be signed. Before unpacking one, check it with the key from this site (not a copy inside the download):

ssh-keygen -Y verify -f rbh-release-signers -I releases@runbackhome.com -n rbh-release -s FILE.sig < FILE

Signing key: /.well-known/rbh-release-signers. Each release will list its fingerprint, and we build every release twice and check the two match.

Report a problem

Email intake@mattcreates.com or text (864) 416-1764. We'll fix what's real and publish what we found within 90 days. Please don't test against anyone's home but your own.

Advisories

None published yet. Fixes that matter to families will be listed here.