Security and privacy

Giving a desktop app access to a production bucket requires more than a promise. Cargocat is designed so credentials stay in the part of the app that talks to storage, files never pass through Cargocat’s servers, and the interface can be made read-only before it touches a real bucket.

Start without credentials

The browser demo runs the real interface against a bundled, read-only sample bucket. It needs no account, installation or storage credentials.

For a first real connection, use a credential limited to the bucket and actions you need. A read-only connection adds a second boundary inside Cargocat: the app refuses writes even if the underlying credential would allow one. See Connect a provider.

Where your keys are stored

Access keys entered in Cargocat are stored in the operating system keychain — Keychain Services on macOS, Credential Manager on Windows and Secret Service on Linux — under the service name app.cargocat.credentials.

Not in a file in your home directory, not in the app’s own settings store, and not on any server of ours. Removing those keychain entries removes the credentials.

AWS profiles and credentials supplied by the environment or cloud host stay in their existing AWS credential chain. Cargocat reads them when connecting rather than copying them into its own store.

Credentials are read only by the native part of Cargocat when it makes a storage request. They do not cross into the interface, file previews or browser demo. Exported connection files contain configuration only and never include keys.

What leaves your machine

Requests to your storage provider, plus anonymous usage data and crash reports unless you turn them off (see below). Cargocat operates no storage proxy or relay: it signs a request with your keys and sends it from this machine to the endpoint you configured, directly or through a network proxy you chose.

The local preview server is reachable only from the same computer, through its loopback address. Other devices on the network cannot connect to it.

A proxy you control

Settings → Network can route storage requests and SSO sign-in through an HTTP or HTTPS proxy, with a bypass list for hosts such as an on-premises endpoint. Feedback and update checks follow that setting too. This computer’s own addresses always bypass it. The app-specific proxy is not applied to Aptabase analytics or Sentry crash reports.

Leave the setting blank to use the system configuration and HTTPS_PROXY as usual. Proxy passwords are not supported yet, because the proxy setting is kept in the app’s settings rather than the operating system keychain.

Preview boundaries

File previews receive only what they need to display an object: bytes and, when a format needs to read different parts of a file, a local URL. They do not receive a connection identifier, storage credential or pre-signed URL.

Some formats use large third-party parsing libraries. Cargocat runs those in a restricted frame, separated from the rest of the app. The frame has an opaque origin and a default-src 'none' content-security policy, and receives bytes through a narrow message channel rather than the local preview URL. This keeps parser code away from both credentials and the token that can read the object.

Safeguards around writes

• Read-only connections refuse mutations inside the app, regardless of what the credential permits.
• Production connections are marked throughout the workspace and require the connection name before destructive actions.
• Editing checks whether an object changed elsewhere before saving and offers to preserve both versions when a conflict is found.
• The activity trail records every mutation locally, while the separate diagnostic log removes secrets and disguises object keys.

Two logs, on purpose

The activity trail records what you changed — the operation, what it applied to, and when. It is for your own reference and it stays on your machine.

The diagnostic log exists for bug reports, and is redacted by construction rather than relying on someone to clean it before sending. Credentials and signed URLs are removed, object keys are replaced by short digests, and your home-directory path is stripped.

Neither log is uploaded unless you choose to attach it to a support email or to feedback sent from the app.

Analytics and crash reports

Both are on by default and anonymous, and one switch turns them off: Settings → Privacy → Share anonymous usage data.

• Usage analytics go to Aptabase: named events from a fixed list, such as “a connection was added” or “a transfer completed”, with the app version, operating system and locale. Never object keys, bucket names, endpoints or file paths.
• Crash reports go to Sentry, scrubbed before they leave your machine: credentials are redacted, and quoted names in error messages are replaced. That filter is best-effort, so an unquoted name in an error can get through. Memory dumps are never sent.

The privacy policy has the full list.

Release integrity

macOS builds are digitally signed and notarized by Apple. Windows installers are digitally signed using Authenticode. These signatures identify the publisher and reveal if the download was modified. Release artifacts also include checksums, and the in-app updater verifies a separate update signature before installing a package.

Every published build remains available in the public release archive, alongside its checksums and release notes.

License verification

Public beta builds need no account or license key and make no activation request. Beginning with the stable release, the app offers a 14-day local trial and periodically verifies a purchased key. It caches a signed entitlement so a licensed app continues to work offline. See Beta and licensing.

Permissions to give it

Cargocat can only do what the credentials you give it allow. If you want it read-only, give it a read-only key — the interface will reflect that, because Cargocat checks what the key can do when it connects.

For day-to-day browsing, a key scoped to the buckets you actually work with is worth the two minutes it takes to make.

Limits worth knowing

• The interface’s read-only setting does not replace a read-only credential.
• A pre-signed share link is a bearer credential: anyone holding it can download the object until it expires. It cannot be withdrawn on its own. See Share an object.
• Open in editor downloads the complete object into a private temporary directory for the duration of that editing session.
• Some providers ignore the save-if-unchanged request used for conflict detection. The app checks and labels that behavior before editing.
• During the beta, Amazon S3 is verified in real use, while MinIO, RustFS and Garage run through conformance and transfer suites. Other presets need broader field testing.