Security

Only you can push code to your app. Here's what protects it.

Signed patches

Every app has its own signing key. Your releases only accept patches signed with it; anything signed with another key, or not signed at all, is ignored.

Verified on every device

Before a device uses a patch, it confirms that:

• the patch is signed with your app's key,
• it's meant for this app and this exact release,
• it hasn't been revoked,
• it arrived complete and unmodified.

If any check fails, the device keeps running its current code.

Who can publish

The signing key is created with the app and kept encrypted by OverPush; there's no key for you to store, back up or leak. A patch is signed only when someone allowed to publish to that app publishes it, and only after the uploaded file is checked against what was declared.

• People need the developer role or higher in the app's organization. See Roles.
• Projects and CI act through a project key, created by overpush init and approved in the browser by a member. A project key works for its one app only, and stops working the moment its member leaves the organization or the key is removed in the console.
• The app id isn't a secret. Knowing it doesn't let anyone publish.

Your login

Sign in with Google or a one-time email code; there's no password. The console's Account page lists every browser and computer signed in, and signs any of them out at once.

Stopping a patch

Anyone with the developer role can stop a bad patch from the console or with overpush patches revoke. See Revoking a patch.

No native code

Patches never contain native code.

Reporting a vulnerability

Email support@overpush.in. Please don't open a public issue for security problems.