Security
How Afar protects your computers.
Reaching a computer from somewhere else depends on strict cryptographic boundaries, human approval at the desk and fast removal when a device goes missing.
Reporting a vulnerability
Send vulnerability reports to security@fromafar.app. Please allow us to ship a fix before sharing unpatched findings in public trackers or forums. Include the affected app or surface, the build or version number, steps to reproduce and what an attacker could reach.
Every good-faith report to security@fromafar.app receives a human reply within 24 hours and a severity assessment with a target fix window within 72 hours. Imagine That AI LLC authorizes good-faith security research against your own devices and accounts so long as you do not access other people’s sessions, degrade service availability or retain data beyond a minimal proof of concept. Within those bounds, we will not bring civil claims or law-enforcement referrals under anti-circumvention or computer-misuse laws, and we coordinate public disclosure within 90 days of your report (or sooner by agreement once a fix is out).
Pairing and session boundaries
Pairing codes and QR links carry no password or bearer token, only where to send the request. A new phone or computer must display the same six-digit code as your Mac, and someone at the Mac must choose Allow. Each approved device gets its own credential in the system’s secure storage (macOS and iOS Keychain, Android Keystore, Windows DPAPI or Linux Secret Service), so removing one device leaves the others working.
Screen sessions open in viewing first. Mouse, keyboard and terminal control require a separate step, show a visible indicator on the Mac while active, and can be taken back from the desk at any moment. Saved actions run only the exact program and arguments you set up in advance, never an arbitrary shell string, and never rerun on their own unless you marked them safe to repeat.
Relay, Settings Sync and downloads
Remote connections enforce TLS certificate validation and SSH host-key checks. On home Wi-Fi and over your own Tailscale or VPN, traffic travels directly between your devices. When you connect through Afar’s relay (Afar Solo and Afar Pro Fleet), the relay forwards encrypted session bytes without inspecting terminal output, screen frames or workspace files.
Optional Settings Sync (512 KiB across up to 32 devices, in preview) encrypts preferences on your device with
AES-256-GCM, wraps the account key per device using RFC 9180 HPKE (P-256),
and protects recovery with a 56-character Recovery Key (PBKDF2-HMAC-SHA256, 210,000 iterations).
Removing a device rotates the sync key generation.
Every installer offered on /download is signed (Apple Developer ID signed, notarized and
stapled on macOS; Authenticode signed on Windows) with its SHA-256 checksum listed beside it and in
/releases.json. Pages on fromafar.app ship under a 'self' Content
Security Policy with no analytics or third-party scripts.
Lost or stolen devices
If a paired phone or laptop goes missing, remove it in Afar on your Mac to cut off local and remote access at once, or end its remote sessions from Disconnect a device: they end at once, and a connection open through Afar’s relay closes within five minutes, or ten if Afar can’t be reached. If a critical protocol vulnerability is found, Afar can raise the minimum host and viewer version its relay accepts, as each app reports its version, so unpatched builds get no relay access until they’re updated.
Related policies
See our Privacy Policy, Terms of Service, End User License Agreement, Delete account and Deleting your data pages, or write to hello@fromafar.app.