Security
Qrulla security
A daily dependency scan, published as it comes out.
Qrulla connects to your databases, so security comes first. Qrulla doesn’t keep your passwords and they never reach our servers: they stay in your system’s keychain. Here is how we protect your data and, every day, the result of scanning the app’s libraries and code, with nothing hidden.
Loading the latest scan…
Reviewed advisories
Published advisories for libraries included in Qrulla, with our assessment of each. Newest first, by the date we detected them.
Fixed advisories
Advisories that affected a library included in Qrulla and that we fixed by updating it. Newest first, by the date of the fix.
01Your passwords, in the system keychain
The passwords of your connections and SSH tunnels are kept in your system's keychain (macOS Keychain, Windows Credential Manager or Secret Service on Linux). Never in a text file, never in a log and never on our servers.
02Your data doesn't go through us
Qrulla connects straight from your computer to your databases. Your tables, rows and queries never travel to our servers. The details are in the privacy policy.
03Encrypted connections
SSL/TLS set per connection (Prefer, Require, or verify the certificate against your CA), and SSH tunnels with your key when the database is not on the internet.
04Signed updates
Every release is signed with our private key, and the app checks that signature before installing an update: if someone changes the file on the way, it is not installed.
05Nothing destructive without confirming
DROP, TRUNCATE, a DELETE without WHERE or replacing an object always ask to confirm with the statement in view. With “Undo changes”, the rows an UPDATE or DELETE changes can be recovered.
06Your account
Passwords stored with Argon2id, optional two-step sign-in, and signed licenses that expire on their own unless renewed.
07A daily review of the libraries
Every day we automatically check all of Qrulla's libraries (Rust and npm) against the public vulnerability databases. If an advisory affects Qrulla, we fix it and ship a release; if it doesn't reach Qrulla, we write it down here with the reason.
08Found a problem?
Write to support@qrulla.com with the subject “Security”. We look at it first.