Nothing leaves your machine. Here is how to check.

No network by default

The free app will make no connection at all until you turn something on. There will be no licence phone-home, no silent update check, no analytics, no crash upload. On first run the update check is presented unticked; you choose.

Verify it: run AsItIs under Little Snitch, LuLu or the Windows Firewall with outbound logging and open a file. You should see nothing. If you ever see a connection that is not on the list below, that is a security bug and we want the report (see disclosure, below).

Every endpoint, published

The Network activity page lists every address the app will be able to contact, with what is sent and when. It has two planned items: the optional update check and the licence resend page, which opens in your browser and is never called by the app. Nothing else. The list will change only with a changelog entry that says so.

No account

There is nothing to sign up for. The free app will have no login. Pro will be a licence file: you buy, the licence arrives by email, you import it. We will not know when you open the app or what you open.

Offline licence files

A licence will be a small file signed with Ed25519. The public key will be compiled into the app; the private key will be kept offline with two backups. Verification will happen on your machine, in native code, with no network. A licence will carry your name or firm, the seat count and an "updates until" date. Nothing in it will be hidden and nothing in it will be checked against a server.

How byte-clean will be tested

The promise is that saving changes only the bytes you edited. It will be enforced, not hoped for. These are the release gates for the app:

• Invariant on every save. Edits are computed as byte ranges against the original bytes. Native code splices those ranges into a copy of the original. Untouched bytes are never decoded and re-encoded, so invalid UTF-8, a lone CR, a BOM and mixed line endings survive exactly.
• Refuse on mismatch. Before the swap, the engine checks that everything outside the edited ranges is identical. If it is not, the save is refused and you are told.
• CI corpus. Every build will open and save the benchmark corpus (6 reports with CRLF, BOM, mixed endings, no final newline, tabs, trailing spaces) plus a fuzz set of 50,000 generated files and must produce byte-identical output. A single failure blocks the release.
• Metadata matrix. Permissions, extended attributes, Finder tags, creation time and symlink targets will be checked after save on macOS and on Windows (NTFS, OneDrive, network share).
• Torn-read protection. When another program (an agent, a sync client) writes the file while it is open, the watcher reads twice and compares hashes before reloading, and a save that would overwrite a newer file restores the other writer's version and shows a conflict banner.
• Network-deny test. CI will run the whole session with outbound traffic denied and fail if the app tries to connect.

Scope today: UTF-8 with or without a BOM, any mix of CRLF, LF and CR, and bytes that are not valid UTF-8, which are carried through untouched. UTF-16 and UTF-32 files are refused with a one-line message rather than rewritten. The public benchmark measures a small reference implementation of the same technique, not this app; the app's own engine will be tested against the corpus and fuzz set above before the first beta build ships, and the desktop app is still in development.

A confirmed byte-integrity bug is stop-ship: fix within 24 hours where possible, and a public post-mortem.

Rendering untrusted files

A report you receive is untrusted input. HTML in markdown is sanitised, SVG and Mermaid render only as images or in sandboxed frames, javascript: and file: links are stripped from exports, and remote images are blocked until you allow them. The webview never sees a raw file path it could redirect.

Releases: signed, checksummed, with an SBOM

Mac builds will be Developer ID signed and notarised. Windows builds will be code signed. Each release will publish SHA-256 checksums, a CycloneDX SBOM of the app and its dependencies, and build provenance, on the GitHub release page. Updates, when you turn them on, will be verified against a signing key compiled into the app before they install.

Disclosure

Report vulnerabilities privately by email to security@asitis.app (the plugin repository also accepts GitHub security reports). We acknowledge within 3 business days and share a fix timeline within 10. The machine-readable version is at /.well-known/security.txt.

In scope: any case where saving changes bytes you did not edit; sanitiser or sandbox bypasses from a crafted file; webview-to-native escalation; MCP server path traversal or writes outside the allowed root; licence or update signature bypass; any connection made without consent.

What the website collects

This site counts page views with Cloudflare Web Analytics. Each page loads a small script from Cloudflare that reports the page address, the site that linked to it, your browser and device type, your country and how fast the page loaded. It sets no cookies, stores nothing in your browser and doesn't follow you to other sites, and we only ever see totals. It stores only what you give the waitlist form: your email, the plan you picked (if any) and the time you consented, in Cloudflare D1, with a Cloudflare Turnstile spam check and no IP address. Details in the privacy policy.