Security is structural, not a feature toggle
Rinko Hub's confidentiality and integrity guarantees come from the Nexa protocol itself — enforced by cryptography, and independently tested, not asserted.
Device identity, not passwords, for protocol access
Every device holds an X25519/Ed25519 keypair. Sessions are mutually authenticated with a Noise-shaped handshake — there is no plaintext mode and no synchronization before authentication.
Sealed labels, not just repository permissions
Content sealed under a label is encrypted with XChaCha20-Poly1305, keyed per label epoch. A user without a grant cannot decrypt it — enforced cryptographically, not by a server-side check that could be misconfigured.
Forward secrecy on every session
Transport sessions use ephemeral X25519 keys discarded after use. A compromised long-term key does not retroactively expose past sessions.
Device keys protected at rest
Device private keys are never stored in plaintext by default: Argon2id-stretched passphrase wrapping (or a platform-supplied key custody implementation) guards the on-disk key container, with transparent migration from unprotected repositories.
Verification on every read
Object integrity is recomputed on every read via BLAKE3, not just at write time — corrupted or tampered objects are rejected before they can be used.
Replay and tamper resistance
Per-session sequence numbers and a session-bound transcript defeat replay; a tampered frame fails authentication before it is processed.
Durability across independent services, not one database
Backend layers are architected to write to more than one independent service before a change is considered durable, with reads falling back automatically when one is unreachable — a single provider outage was never meant to be a single point of failure.
Reporting a vulnerability
If you believe you've found a security issue in Rinko Hub, please report it privately rather than opening a public issue. We investigate every report and credit researchers who give us a reasonable window to respond before disclosure.