Security
Reinstate Security: Local Encryption and BYO Storage
Reinstate encrypts selected Claude Code and Codex session artifacts locally with age passphrase encryption before uploading ciphertext to storage you control. Vendor credentials are excluded, storage keys remain in the OS keyring, and restores use backups, atomic writes, and explicit conflict handling.
- Last verified
- Current release
- v0.1.0-rc.8
- Release status
- pre-1.0 release candidate
- Owner
- Harjot Singh Rana
Security properties at a glance
- Remote payloads
- age-encrypted ciphertext
- Storage ownership
- Your S3-compatible or R2 bucket
- Session passphrase
- Not stored by Reinstate
- Storage credentials
- Operating-system keyring
- Vendor API access
- Not required
- Formal security audit
- Not claimed for pre-1.0
Where plaintext exists
- A supported adapter reads selected local session files from Claude Code or Codex.
- Reinstate normalizes known structural paths and builds the portable artifact on the local machine.
- The artifact is encrypted locally using an age scrypt recipient derived from your passphrase.
- Reinstate sends ciphertext over TLS to your configured S3-compatible endpoint.
- Another configured device downloads the ciphertext, decrypts it locally, remaps paths, and restores the native files.
The object-storage provider does not receive plaintext session content or the passphrase from Reinstate. It can still observe bucket access, object timing, size, and opaque object keys.
Encryption and key handling
| Property | Current behavior |
|---|---|
| Payload encryption | age passphrase encryption with an scrypt recipient |
| Multi-device decryption | Enter the same long passphrase on each trusted device |
| Passphrase storage | Not stored; interactive commands read a hidden terminal prompt |
| Automation | Use a pre-opened file descriptor through REINSTATE_PASSPHRASE_FD; ordinary environment variables and CLI passphrase flags are rejected |
| Storage credentials | Stored in the native OS keyring, not in config.toml |
There is no passphrase recovery.
Use a long, unique passphrase and keep it in a trusted password manager. Losing it means losing the ability to decrypt remote artifacts; that is a consequence of the design, not an account-recovery bug.
Credentials and files excluded from sync
Phase 1 hard-excludes agent authentication files, API keys, OAuth tokens, credential stores, OS keyring contents, caches, logs, and regenerable dependency directories. Credential and authentication paths cannot be opted back into sync.
| Example | Reason |
|---|---|
**/auth.json | May contain API or OAuth material |
**/.credentials.json | May contain tokens |
| Claude OAuth or keychain material | Device-local credentials |
node_modules, .venv, caches | Large, regenerable, and non-portable |
This boundary does not inspect the semantic meaning of every transcript line. If a tool prints a production secret into an agent conversation, that secret becomes part of the encrypted transcript. Avoid pasting secrets into agent chats and rotate any exposed credential.
Restore and conflict safety
- Use
pull --dry-runto inspect planned changes before a restore. - Existing local files receive timestamped backups before replacement.
- Writes use a temporary file and atomic rename.
- Divergent changes create explicit conflict records and forks.
- Active Claude Code or Codex processes are refused before mutating session restores.
- Artifact metadata and hashes are authenticated and validated before use.
Threats and boundaries
| Threat | Mitigation or boundary |
|---|---|
| Storage provider reads session content | Client-side encryption; remote payload is ciphertext |
| Network eavesdropping | TLS plus an already-encrypted payload |
| Accidental credential-tree sync | Hard exclusions and narrow adapter discovery |
| Overwrite of good local history | Dry-runs, backups, atomic writes, and conflict forks |
| Compromised local machine | Out of scope; plaintext is necessarily available during local use |
| Malicious or vulnerable release | Checksums and supply-chain controls reduce risk; independent verification is encouraged |
Audit status and responsible disclosure
Reinstate is open source under Apache-2.0, but source availability is not the same as a formal audit. No independent formal audit is claimed for RC8. Review the code and threat model before using sensitive transcripts.
Report suspected vulnerabilities privately using the repository'ssecurity policy. Do not open a public issue for an unpatched vulnerability.