A readable security model, with its limits

Your signing keys

Android keys (keystore, passwords) are encrypted with AES-256-GCM envelope encryption. Each secret has its own envelope, bound to your organization and to the key concerned: an envelope copied elsewhere cannot be decrypted.

• Only the signing service receives a key's material, for a given job, and every use is logged.
• A revoked key has its secrets destroyed; revocation requires a password confirmation.
• Keys generated by PWA2APP are created in the signing zone; you can also import your own.

Build and signing are separate

The build is run by a compilation worker. Signing a production version is done by another, dedicated service. The build worker never holds your keys.

• Workers talk to the orchestrator over mutual TLS, with short-lived certificates.
• Workers have no access to the database.
• The configuration embedded in the app is signed by the orchestrator; the worker does not hold the key that signs it.
• Compilation processes run with an environment stripped of any sensitive variable.

What PWA2APP does not see

PWA2APP stores neither your passwords in clear nor your end users' data. Generated applications collect no personal data from the end user.

Import protection

• Imported addresses go through a fetcher protected against SSRF attacks: private ranges, cloud metadata addresses and redirects to internal targets are refused.
• Archives are extracted with protections against crafted paths, symbolic links and archive bombs.
• For a production version, you must prove that you control the PWA's domain.

Accounts and access

• Two-factor authentication with a TOTP app, recovery codes and passkeys.
• Sensitive actions (revoking a key, deleting) require you to confirm your identity.
• Sessions use protected cookies (HttpOnly, SameSite) and CSRF protection.
• Organizations are isolated at the database level (row-level security): every query is limited to one organization.
• An activity log keeps the organization's important actions.

This website

This site is static: no account, no password, no tracking cookie, no third-party script. A strict content security policy prevents it from loading anything external. The "Log in" links lead to the application, never to a form on this site.

Acknowledged limits

• The Bridge has not been tested on real devices so far.
• No independent security audit has been carried out yet.

Report a vulnerability

Write to security@pwa2app.tech. The site's security.txt file describes the contact and the disclosure policy. We acknowledge receipt and keep you informed of the fix.