The short version
- Steerglass connects directly from your computer to your clusters. Your kubeconfig, credentials and cluster data never reach us, and the app has no telemetry.
- Every update is signed, and the app refuses to install one whose signature doesn’t match the key built into it. The signing key is not on the web server: whoever controlled steerglass.com still couldn’t push an update.
- The macOS app is signed and notarized by Apple; Linux packages and repositories are signed with our GPG key; every release has SHA-256 checksums.
- Found a vulnerability? Write to [email protected].
Downloads
| System | How it’s signed |
|---|---|
| macOS | Signed with our Apple Developer ID (Davide Bettio (79AHY83MQ9)) and notarized by Apple, so Gatekeeper opens it without warnings. The Homebrew cask pins the SHA-256 of each release. |
| Linux | The .deb and .rpm packages and the apt and dnf repository indexes are signed with the Steerglass repository key: BF36 B823 7521 CA83 88E0 02C7 91F9 627C E6D9 1421 (steerglass.asc). |
| Windows | The installers are not code-signed yet — we’re working on it — so SmartScreen may show a warning the first time. Check the SHA-256 below before running them. |
Checksums
Every release has a sha256sums.txt next to its files, for example releases/0.2.4/sha256sums.txt. The install page lists the checksums of the current downloads. To check a file:
macOS: shasum -a 256 steerglass-mac.dmg Linux: sha256sum steerglass-linux-x86_64.appimage Windows: Get-FileHash .\steerglass-windows-setup.exe (PowerShell)
Updates
The app checks https://steerglass.com/updates/latest.json every few hours. Each update file comes with an Ed25519 (minisign) signature, and the app verifies it against the public key built into it — key ID FABA82CF882C9B78 — before installing. An update that doesn’t verify is discarded.
The private key that signs updates lives only where releases are built — our build machine and the encrypted secrets of our CI — never on the server that hosts the downloads. Copies installed from our apt or dnf repository update through your package manager, which checks our GPG signature.
What the app connects to
- Your clusters, directly, with the credentials in your kubeconfig.
- steerglass.com, to check for and download updates and, if you signed in, to renew your license. Nothing about your clusters is sent.
The details are in the privacy policy.
Reporting a vulnerability
If you find a security problem in the Steerglass app, steerglass.com or the update and download infrastructure, write to [email protected] with “Security” in the subject. Include what you found, how to reproduce it and what an attacker could do with it.
- We’ll reply within 3 working days and keep you posted until it’s fixed.
- Please give us 90 days, or until a fix is released if that’s sooner, before disclosing it publicly. We’re happy to credit you in the changelog.
- Research in good faith is welcome and we won’t take action against it. Please don’t access other people’s accounts or data, don’t degrade the service (no load or denial-of-service testing) and don’t use social engineering.
- There’s no paid bug bounty at the moment.
The same contact is published in /.well-known/security.txt.