Security

TermAI is an SSH client — security is the product. If you believe you've found a vulnerability, we want to hear from you.

Reporting a vulnerability

Email [email protected] (or [email protected]) with a description of the issue, steps to reproduce, and the affected version/platform. Please give us a reasonable window to fix it before any public disclosure. We aim to acknowledge reports within 3 business days.

We don't run a paid bounty program yet, but we credit reporters (with your permission) once a fix ships.

How TermAI protects you

• Key & credential storage — SSH private keys and passwords are held in the platform secure enclave (iOS Keychain / Android Keystore), never in plaintext.
• Host-key verification (TOFU) — the server fingerprint is recorded on first connect and you're alerted if it ever changes, defending against man-in-the-middle attacks (same model as OpenSSH).
• End-to-end encrypted cloud sync — SSH connection configs and AI chat history sync encrypted with AES-256; sync is opt-in (Pro) and off by default.
• Direct connections — SSH/SFTP sessions go device → server directly. Built-in Tailscale traffic is end-to-end encrypted and needs no public IP.
• Minimal data — we don't collect the contents of your terminal sessions. AI requests are sent only to the AI provider you use, to fulfill the request.

Scope

In scope: the TermAI iOS and Android apps and the termai.sh backend. Out of scope: issues in third-party SSH servers you connect to, social engineering, and reports that require a rooted/jailbroken device or physical access to an unlocked phone.

Related: Privacy policy · Terms · About