Architecture

Security model

Dits is a local alpha, not a hosted security platform. This page separates implemented integrity checks from confidentiality, authentication, and network features that do not exist.

Alpha boundary

Use Dits only with disposable or independently backed-up data. There is no supported repository encryption, remote authentication, authorization system, managed backup, compliance certification, security SLA, or 24/7 incident-response service.

Current trust boundary

Repository files and objects live under the permissions and protections of the local operating system and filesystem.
Objects are content-addressed and checked against their hashes when read; dits fsck re-hashes repository objects and checks manifests, commits, refs, and graph structure.
Hash checks can detect many forms of corruption. They do not encrypt data, establish the author's identity, or stop an attacker who can replace both content and references.
Commits and repository metadata are not cryptographically signed by a supported identity system.

# Check internal repository consistency
dits fsck

# Record independent hashes for important restored files
shasum -a 256 path/to/file             # macOS
sha256sum path/to/file                 # Linux
Get-FileHash path/to/file -Algorithm SHA256  # PowerShell

Confidentiality and keys

The repository-encryption experiment is disabled because it did not cover every storage engine or metadata path. encrypt-init, login, and change-password fail nonzero without changing repository or keystore data. Repositories containing the legacy experimental keystore fail closed.

Use filesystem permissions, full-disk or volume encryption, encrypted backups, and physical access controls appropriate to your environment. See the encryption status page for recovery cautions.

Network surfaces

push, pull, fetch, and sync are disabled and return nonzero without transferring data or changing a repository. Local-path clone works; network clone does not.

Do not expose dits serve

The experimental dits serve utility binds to all interfaces and does not implement authentication, authorization, or TLS. Treat it as a developer fixture for an isolated, trusted network only. Do not expose it to the internet or an untrusted LAN.

CLI telemetry

CLI telemetry is disabled by default. When explicitly enabled, the current client records a limited command event: command name, argument count, flag count, whether any argument looks like a path, CLI version, platform, a random installation identifier, a random process identifier, and a timestamp. The event constructor does not include argument values, file paths, repository names, usernames, machine IDs, or file contents.

Enabled telemetry attempts an HTTPS POST to the endpoint compiled into the CLI. Disabling telemetry stops future event recording and delivery attempts; it does not by itself remove the persisted random identifier or last-send timestamp from global configuration.

dits telemetry status
dits telemetry enable
dits telemetry disable

Website behavior is documented separately in the website privacy notice.

Safe evaluation practices

Keep an independent source copy and test restores before relying on them.
Run with the least filesystem privileges practical.
Do not place secrets in a repository assumed to be encrypted by Dits.
Do not treat a configured remote as a backup; transfer is disabled.
Record the exact Dits version when preserving or exchanging a repository.
Re-run integrity checks after interruption, migration, or suspected damage.

Reporting security issues

Use the details-free security contact form to ask a maintainer to arrange private follow-up. The request is public, so include no vulnerability details, proof of concept, secrets, affected data, paths, or logs. The project does not promise a bounty, response deadline, embargo window, or remediation SLA. General bugs can be filed in the public issue tracker.