Privilege model
The installed edition runs with administrator privileges so it can work with elevated targets. The portable edition runs as the current standard user and cannot inject input into elevated applications. Portable data stays beside the executable rather than falling back to another location.
Input safety
- Captured key identities are never logged, persisted, or transmitted.
- Raw physical timing samples remain local and bounded in memory.
- Debug key events are cleared when debug mode is disabled.
- Modules are statically linked and receive only narrow typed capabilities.
- Pending work is cancelled and synthesized keys are released on quit, restart, reset, or shutdown.
Verified updates
SnapKeyNext makes one bounded startup request to snapkeynext.com. An update downloads only after you select the update action. The client refuses redirects, constrains the host and path, authorizes the request with its signed client JWT, limits package size, and verifies the CI-published SHA-256 hash before launching an installer or portable updater. Website packages require the corresponding signed website JWT cookie. The Worker runs its same-origin browser and automated-client checks before issuing that cookie and repeats them when the package is requested.
Report a vulnerability privately
Do not publish exploit details or include unrelated captured input, credentials, or personal paths. Use the private support contact and include the affected version, reproduction steps, impact, and required configuration.