JstSync

Report a security issue

Found a way to read, change or send files that the person who owns the phone or the computer did not allow? Tell the developer privately first, so it can be fixed before anyone else learns about it.

Last updated: 1 October 2026

How to report

  1. 1 Email mpashkov.work@gmail.com with “Security” in the subject. Encrypt it with the key under “Security contact” if the details are sensitive.
  2. 2 Keep it private until a fix is out, or until 90 days have passed, whichever comes first. Please do not open a public issue or post about it.
  3. 3 Test only on your own devices. Use a phone and a computer you own, and files you made for the test.

What to include

  • Versions Desktop app version (About JstSync) and phone app version (Settings), plus Windows, Ubuntu and Android versions.
  • Steps to reproduce What you did, in order, from a fresh pairing if you can.
  • What you expected and what happened And who could do it: someone on the same Wi‑Fi, an app on the phone, a user of the computer.
  • Proof, kept small A script, a screenshot or a log excerpt. Remove pairing codes and anything personal first.

What is in scope

In scope
  • The JstSync desktop app for Windows and Ubuntu
  • The JstSync app for Android from Google Play
  • Pairing: the QR code, the pairing code and the certificates
  • The connection between phone and computer, and how the phone finds the computer
  • Where the desktop writes files, and what it deletes
  • The downloads on jstsync.com and their checksums
Not in scope
  • Attacks that need someone already in control of the unlocked phone or the computer’s account
  • Floods or denial of service on your own network
  • Social engineering, phishing or physical access
  • Bugs in Android, Windows, Ubuntu or the browser itself; report those to their makers
  • Missing best-practice headers on jstsync.com without a working attack

Security contact

Reports go to the developer only.

Email a report
Email
mpashkov.work@gmail.com
Languages
English
Encryption key (OpenPGP)
7A18 526C 71C8 1CEA ED4B EA55 A03C F799 9881 2926Download the public key
Machine-readable
/.well-known/security.txt

Not a security problem? Use mpashkov.work@gmail.com for help and other questions.

What happens next

  1. Within 3 working daysYou get a reply saying the report arrived, with a reference.
  2. Within 7 daysThe issue is confirmed or explained, with a first estimate of how serious it is.
  3. A fixed releaseBoth apps share one version number, so a fix ships as a new release on Google Play and jstsync.com together.
  4. Credit, if you want itThe release notes name you, or not, as you choose.

Research in good faith is welcome

If you follow this page, stay on your own devices and report privately, the developer will not take legal action against you for it. Maksim Pashkov can only speak for itself, not for Google, Microsoft or Canonical.

How JstSync is built to keep files private

Useful background before you start. A way around any of these is exactly what to report.

Both sides check each other TLS 1.3 with pinned certificates on both ends. The phone’s key never leaves the Android Keystore.
Pairing needs the code Only a phone that scanned the computer’s QR code can pair. Everything else on the desktop answers paired phones only.
Writes stay in the folder The desktop never follows a link out of the download folder and never writes outside it.
No developer server Files go only between your two devices. Logs leave out names, paths and pairing codes.