>_ v-Shell

How v-Shell protects you

Updated 2026-11-02 · v1.0

Checked before you sign in

The first time you connect, v-Shell shows your computer's identity and waits for you. Your password isn't sent until you confirm. If a saved computer's identity ever changes, v-Shell refuses to connect.

Your private key stays on this device

v-Shell makes a key on this device and keeps the private part in the iOS Keychain. It isn't synced and can't be restored onto another device. Only the public part goes on your computer. Your password is used once to set that up, and it's never saved.

Links never connect on their own

A setup link or QR code only fills in a form. You see the real address, and nothing connects or runs until you tap.

One lock covers everything

With Face ID lock on, open terminals, sheets and the app switcher are all covered. Turning the lock off needs Face ID too.

Nothing to collect

No account, no analytics, no server of ours. Terminal traffic goes straight from your device to your computer, encrypted by SSH. Check it yourself: Settings › Privacy & Security › App Privacy Report.

How we check

Every release gets AI-assisted security code reviews, unit tests, and live tests against a real OpenSSH server. v-Shell hasn't had a paid third-party penetration test yet.

Limits, today

Third-party keyboards can see what you type in the terminal, except at password prompts, where v-Shell switches to the Apple keyboard. If that worries you, use the Apple keyboard.
RSA keys and keys with a passphrase aren't supported yet.

For the technical

Host keys are pinned per computer and checked by SHA256 fingerprint. There is no silent trust on first use. Setup links from setup.sh carry the fingerprint and are checked automatically.
Key exchange: curve25519-sha256 or ECDH over NIST curves. Ciphers: AES-GCM only (aes256-gcm@openssh.com, aes128-gcm@openssh.com). No compression, no plaintext fallback.
Keys are Ed25519 or ECDSA, stored with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, which allows reconnecting in the background.
Channels the server opens (forwarding, X11, agent) are refused. Keyboard-interactive login answers only a password prompt, and only once.
Clipboard writes from the server (OSC 52) stay on this device, expire after 10 minutes, and show a notice. The server can't read your clipboard.
iCloud sync (optional) never carries keys, and synced computers arrive without startup commands.

Report a problem

Email support@cerebro.host with "Security" in the subject. We reply within 2 days. If you test in good faith, only on computers you own, we won't take legal action against you. There's no bug bounty.