How Afar protects your computers.

Last updated October 27, 2026. Applies to fromafar.app, the Afar installers and apps, and Imagine That AI LLC’s coordinated vulnerability disclosure program.

Reporting a security vulnerability

Send vulnerability reports to security@fromafar.app. Please do not post unpatched vulnerabilities in public issue trackers or forums before a fix is available. Include the affected app or surface, version or build number, reproduction steps and impact assessment.

• Acknowledgement under 24 hours. Every good-faith report to security@fromafar.app receives a human acknowledgement within 24 hours.
• Triage within 72 hours. Confirmed issues receive severity classification and a target remediation timeline within 72 hours.
• 90-day coordinated disclosure safe harbor. Imagine That AI LLC authorizes good-faith security research conducted against your own devices and accounts without accessing other users’ sessions, disrupting service availability or retaining data beyond minimal proof of concept. For good-faith research within these rules, we will not initiate civil action or law-enforcement referral under anti-circumvention or computer-misuse laws, and we coordinate public disclosure within 90 days of report receipt (or earlier upon joint agreement once a fix ships).

Security architecture and boundaries

• Two-handed pairing with per-device credentials. Pairing codes and QR links carry no bearer token or password—only discovery coordinates. A new viewer must display the same six-digit verification code as your Mac, and someone at the Mac must choose Allow. Each approved device receives its own scoped credential stored in the operating system’s secure storage (macOS/iOS Keychain, Android Keystore, Windows DPAPI or Linux Secret Service) so revoking one device leaves the others intact.
• Viewing separated from interactive control. Screen sessions open in read-only viewing by default. Interactive mouse, keyboard or terminal control requires an explicit grant, displays a visible on-screen indicator on the host Mac and can be reclaimed from the host at any moment.
• Fixed-argv saved actions. Configured job actions run exact executable and argument vectors that you reviewed in advance, never an unauthenticated shell string, and never re-run automatically unless marked safe to rerun.
• Transport-only relay and certificate validation. Remote connections enforce TLS certificate validation and SSH host-key checking. When traffic uses the managed Afar relay (Afar Solo and Afar Pro Fleet), the relay forwards encrypted session bytes without inspecting terminal streams, desktop frames or workspace files.
• Zero-knowledge Settings Sync. Optional Settings Sync (512 KiB across up to 32 devices, preview) seals records on the client with AES-256-GCM, binds metadata in authenticated additional data, wraps the account key per device using RFC 9180 HPKE (P-256) and protects account recovery with a 56-character Crockford Base32 Recovery Key (PBKDF2-HMAC-SHA256, 210,000 iterations). Removing a device rotates the sync key generation.
• Signed, checksummed installers and strict web CSP. Every downloadable installer on /download is code-signed (macOS Developer ID signed, notarized and stapled; Windows Authenticode signed) with its SHA-256 digest published beside it and in /releases.json. Ordinary pages on fromafar.app ship under a 'self'-only Content Security Policy with zero third-party scripts or analytics.

Emergency containment and stolen-device response

If a phone or laptop paired with your Mac is lost or stolen, you can remove that device immediately from the Afar app on your Mac (cutting off its local and remote sessions at once) or trigger account-wide session and relay token revocation. When a critical protocol vulnerability is discovered, Afar’s control plane can raise the minimum required host and viewer build floor (min_host_version and min_client_version) within 60 seconds so unpatched builds fail closed until updated.

Related policies

Read our Privacy Policy, Terms of Service, End User License Agreement, Account Deletion and Data Deletion guides, or write to hello@fromafar.app for general questions.