Currently, only the latest release of Zipline is actively supported with security updates.
| Version | Supported |
|---|---|
| 0.1.0 | ✅ |
| < 0.1.0 | ❌ |
Zipline transfers data strictly over your Local Area Network (LAN). No data ever touches the cloud. All WebSocket (port 8080) and TCP file transfers (port 8081) are end-to-end encrypted using AES-256-GCM.
Session keys are derived via PBKDF2 (100k iterations, HMAC-SHA256) from a 32-character secure random session token negotiated during the QR code handshake.
Known Limitations:
- Forward Secrecy is not currently implemented (planned via ECDH).
- Connection is vulnerable if the QR code is photographed by a malicious actor within its 60-second rotation window.
If you discover a security vulnerability within Zipline, please do NOT report it via public GitHub issues. Instead, please email the maintainers directly. We will address and patch critical vulnerabilities as our highest priority.