Project information

Security

How to report a vulnerability without exposing sensitive details, and how to check a download.

Do not report vulnerabilities publicly.

Use GitHub's private vulnerability reporting so details are not exposed in the public issue tracker.

What to include

Enough to reproduce and assess the issue: the subshell version, Android version and the steps.

Do not include Reddit credentials, OAuth access or refresh tokens, cookies, passwords, private messages, signing material or other personal account data.

Supported builds

Security fixes target the newest public beta unless the release notes say otherwise.

Checking a download

Every release is signed with the same release key and published on GitHub Releases with three files: the APK, a .sha256 checksum and a release record (source commit, checks run, signing certificate digest). Compare the checksum before installing; the in-app update dialog shows the same value.

The checksum sits in the same release as the APK, so it only shows that the download is not damaged. To check that an APK is really signed by subshell, compare its signing certificate with this SHA-256 fingerprint, which is published here and in the README, outside the release:

52:E9:62:E7:41:2E:25:DA:80:1E:0A:39:06:E0:BF:B4:39:90:0A:1A:A1:5B:A9:F9:3C:95:B4:99:55:BA:F5:84

On a computer, apksigner verify --print-certs Subshell-<version>.apk (Android SDK build-tools) prints it as Signer #1 certificate SHA-256 digest, in lower case without colons. On the phone, the AppVerifier app checks it before you install.

Android refuses to install an update signed with a different key, so an installed subshell only accepts genuine updates.