Security by default
Ghost FTP uses fail-closed integrity checks, first-party delivery paths and protocol verification rather than bypassing operating-system or antivirus protections.
Effective 27 September 2026. This is a technically prepared production policy draft and should receive final legal review before it is relied on as jurisdiction-specific legal advice.
Official download files are allowlisted by exact filename and expected SHA-256. The download service verifies deployed file size and hash before serving a package. A mismatch causes the request to fail rather than silently serving an altered binary.
Native desktop updates require the updater package and its Tauri updater signature. The public update endpoint must not advertise an unsigned package. Update packages are staged and re-hashed before being streamed to the application.
First-party services are intended to operate over HTTPS. FTPS certificate verification is not disabled to make a connection succeed. SFTP host-key handling uses TOFU or explicitly configured pinning and does not silently accept a changed key.
Web FTP passwords are processed for the active connection and are not written to remembered-server browser storage. Server logs must not intentionally record passwords or private-key material. Desktop credential storage follows the capabilities of the native platform and application configuration.
Report suspected vulnerabilities privately through the official Ghost FTP contact channel. Include affected version, reproducible steps, impact and any relevant logs with secrets removed. Do not perform destructive testing against production infrastructure.
Credible reports are triaged according to severity and reproducibility. Security fixes may be released outside the normal feature cadence. Public disclosure timing should allow a reasonable remediation window where users would otherwise be exposed.