How Portty stays safe

Threat model

Portty gives your phone a terminal to a real machine. That means a pairing bug, a stolen unlocked phone, or a key compromise hands over the whole machine — remote code execution by design, not just data exposure. One serious CVE ends trust. Everything below exists to keep that risk bounded.

Transport & crypto

• Encrypted peer-to-peer — devices reach each other LAN-direct, then NAT-punched, then relay-forwarded. No open inbound ports.
• End-to-end encryption — every payload is sealed between your devices with per-pair keys that never leave them. Relays see only ciphertext — never your keystrokes or output.
• Real device identity — each device carries its own identity key, so both ends always know exactly who they’re talking to.
• Sealed by design — Portty’s keys are scoped to Portty alone and can never overlap with anything else.

Pairing

Pairing only opens when you run portty pair — starting the host never opens it and never prints a key. It shows a single-use QR ticket; after the phone connects, both screens show the same 6-digit code and you approve it at the computer. A stolen QR (or intercepted ticket) cannot pair on its own: the attacker would still need you to approve a code they can’t see, and the ticket stops working once your phone pairs. There’s deliberately no PIN. Afterwards the phone reconnects by a persisted token.

Relays

Your phone and computer connect directly whenever they can: on the same network, or through a punched-through link. To find each other — and to carry the connection when no direct path exists — both use free public relay servers and a lookup service run by n0, the company behind the open-source iroh library Portty is built on. Corvux Mindware runs no server in the middle.

The relays forward end-to-end encrypted data they cannot read. Like any internet server, they see each device's IP address, plus the device's public key, which works as a random device ID. The privacy policy lists exactly what they can see.

Controls

• Biometric lock on the phone app.
• Instant revoke — portty-host revoke <id> drops a paired device within ~2 seconds.
• Structured by default — the agent layer presents structured Approve/Deny; raw shell access is opt-in.
• Signed binaries on all platforms.

Host stays dumb

The host daemon just moves bytes — it never interprets what’s inside your terminal. Scrollback is held in bounded memory so it can’t grow without limit, and the device identity key is treated as secret material: never logged, never synced, and wiped from memory when no longer needed.

Open source

Portty’s full source code is public under the Apache-2.0 license at github.com/corvuxmindware/portty, so anyone can check how pairing, encryption and approvals really work. Found a security problem? Report it privately through GitHub’s private vulnerability reporting, or email support@meetcorvux.com.

Honest limits

• Closed laptops are unreachable. Portty is built for always-on machines (server / desktop / Pi). We won't pretend "from anywhere" works through a closed lid.
• It looks like a reverse shell. An outbound tunnel plus remote command execution is structurally similar to malware. Expect EDR to flag it; mitigate with signed binaries, clear docs, and self-host mode.
• You are the attack surface's admin. Keep your phone locked, revoke lost devices immediately, and prefer self-host / LAN / Tailscale.