Hey Look!
EN
Download

Security

What we do, and where it stops

Facts only. No promise of outcomes: nobody can make one.

How Hey Look! protects you

  • Servers must offer TLS or STARTTLS. A server that offers only unencrypted connections cannot be added.
  • Google and Microsoft sign-in use OAuth 2.0 with PKCE in the provider’s own window. The app stores a token, not your password.
  • Passwords, OAuth tokens and the AI key are kept in the system credential store.
  • OpenPGP secret keys are the exception: they are stored in the app’s database, locked with your passphrase, and are not in the credential store. After repeated wrong passphrases, unlocking waits 30 seconds.
  • Messages are shown in a frame with no scripts, a restrictive content policy and no iframe, object, embed or form.
  • Remote images are blocked until you allow them, which stops tracking pixels.
  • A link whose visible text is a web address that points to a different host asks you to confirm. This is not a general phishing check.
  • Opening an executable or script attachment asks first.
  • “Trust this certificate” is off by default. It is a per-account choice and turns certificate checks off for that account.
  • The app’s own window runs under a Content Security Policy: only the app’s own scripts run (no inline or remote scripts), and the window connects only to the app itself.
  • Text pasted from a web page or another program is cleaned: scripts, forms and event handlers are not brought in, and remote pictures are not fetched while you write.

Updates are signed

The app checks GitHub for a newer version and only accepts download addresses of the form https://github.com/thnonl/hey-look/releases/download/<tag>/<file>. It verifies a minisign signature against a public key built into the app, and restarts after a 5-second countdown that you can cancel. On Windows the update installs by itself; macOS and Linux need your permission.

Installers are not code-signed yet

Windows SmartScreen and macOS Gatekeeper warn on first start, because the Windows and macOS installers are not code-signed and the macOS build is not notarised. The first-start steps are on the download page. Signing is on the wish list; see Support for what helps. The macOS app is signed with the project’s own self-signed certificate (no Apple account behind it); this lets the Keychain keep remembering the app across updates, but it is not notarisation.

Report a vulnerability

Please report security problems privately through GitHub: open github.com/thnonl/hey-look/security and choose “Report a vulnerability”. Do not open a public issue. You can also write to namth.onl@gmail.com. Hey Look! is made in spare time, so answers can take a while, and no response time is promised.

Known limits

  • Updates and cancellations of calendar invitations are accepted when the From address equals the stored organiser. There is no DKIM, SPF or S/MIME check, so a forged From address could change or cancel an event you received. Mail providers normally reject such spoofing.
  • OpenPGP has not yet been tested against other OpenPGP software.
  • The AI Assistant sends the text you ask about to the endpoint you configured, including decrypted OpenPGP content. It is not private from that endpoint.
  • The “no analytics” statement is verified from the source code, not by a network capture.
  • No third-party security audit is claimed.
  • A message marked Confidential is hidden from screen capture and recording on Windows and macOS only; it does not stop a photo of the screen.