Tsaro
Yadda aka gina rumbun ajiya, da kuma irin fasawar da za a samu.
An sabunta shi na ƙarshe a ranar 21 ga Satumba, 2026 · AssuredAuth, ta CircleRoll LLC
Wannan shine bayanin jama'a game da yadda AssuredAuth ke kare sirrin abubuwa biyu, kalmomin shiga da katunan da kuke ajiyewa a ciki. An rubuta shi ne domin mai karatu mai sha'awar tsaro ya iya duba kowace da'awa akan app ɗin da kuma akan vectors ɗin gwaji da aka buga (yana samuwa ga duk mai bita idan an buƙata a hello@assuredauth.com). Yana faɗi abin da yake gaskiya kuma babu ƙari: babu wani abu a nan da ya yi iƙirarin cewa ya wuce hari, kuma babu wani abu da aka yi alƙawarin yi a cikin kaso.
Gajeren sigar: rumbun ajiyar yana nan a wuri ɗaya, wayarku. Kowace ƙima a cikinta an ɓoye ta da maɓalli wanda kayan aikin tsaro na wayar ke riƙe da shi kuma ba za a iya fitarwa ba. Ba mu gudanar da sabar rumbun ajiyar bayanai ba, ba mu riƙe kwafi ba kuma ba mu riƙe maɓalli ba. Fayil ɗin ajiya yana barin wayar ne kawai bayan an ɓoye ta a ƙarƙashin kalmar sirri da ba a taɓa adanawa a ko'ina ba.
Yi rahoton matsala: hello@assuredauth.com. Duba "Rahoton rauni" a ƙarshe.
1. Me ake ɓoyewa, da me?
| Bayanai | A waya | Maɓalli |
|---|---|---|
| Sirrin abubuwa biyu (TOTP/HOTP/Turamin tsaba) | A wayaShagon Keychain (iOS) / Android Shagon Keystore mai goyan bayan Keystore | MaɓalliMaɓallin da aka ɗaure da kayan aiki na dandamali; layin bayanai yana ɗauke da ma'anar kawai (secretRef), ba iri ba |
| Kalmar sirri (ƙimar kalmar sirri, bayanin kula) | A wayaLayi mai rufewa: AES-256-GCM, lambar nonce 96-bit bazuwar kowace ƙima | MaɓalliMaɓallin bayanai na 256-bit bazuwar, wanda aka lulluɓe shi da maɓallin hardware a cikin §2 |
| Katunan (lamba, ƙarewa, suna a kan kati, CVC) | A wayaHatimi iri ɗaya da kalmomin shiga; CVC zaɓi ne kuma ana adana shi ne kawai idan kun shigar da shi | MaɓalliMaɓallin bayanai iri ɗaya |
| Bayanan metadata (sunayen sabis, sunayen masu amfani, gumaka, tsari na tsari) | A wayaBayanan manhajar (SwiftData / Room) | MaɓalliAn kare shi ta hanyar ɓoye fayilolin tsarin aiki; an yi masa kallon wanda ba sirri ba ne |
| Fayil ɗin ajiya (.authbackup) | A wayaDuk inda ka sanya shi: Fayiloli, iCloud Drive, Google Drive appDataFolder, takardar rabawa | MaɓalliMaɓalli da aka samo daga kalmar sirrinka (§3). Apple da Google suna karɓar fayil ɗin da aka rufe ba tare da wani abu ba. |
| Manhajar abokiyar Watch / Wear | A wayaMaɓallin Maɓalli / Abubuwan da aka ɓoye na agogon | MaɓalliMaɓallan dandamalin agogon; an canza su ta hanyar tashar na'urorin haɗin gwiwa na dandamalin |
| Ziyarar tsawaita tebur (lambobin lokaci ɗaya idan an buƙata) | A wayaBa a adana ba; an watsa shi azaman ambulaf ɗin ɓoyayye daga ƙarshe zuwa ƙarshe | MaɓalliMaɓallin X25519 guda ɗaya a kowace haɗuwa, maɓalli na sirri a cikin Keychain / Keystore; relay yana ganin rubutun sirri kawai |
Binciken cuta ba shi da wata hanyar da za ta yarda da sirri. Babu wani taron nazari da ke ɗauke da filin ajiya. Babu wani ƙima daga rumbun ajiya da aka taɓa rubutawa a kan gungume, a cikin kowane gini.
2. Inda makullan ke zaune, a kowane dandamali
iOS. Ana naɗe maɓallin bayanai ta hanyar maɓalli da aka samar a cikin Secure Enclave (kSecAttrTokenIDSecureEnclave) tare da ikon shiga .privateKeyUsage + .userPresence, accessibility …ThisDeviceOnly, a cikin rukunin shiga na Keychain da aka raba na app ɗin don haka tsawaita Cika AutoFill zai iya amfani da maɓalli ɗaya. Ba za a iya karanta maɓallin sirri daga Enclave ta app ɗin ba, ta hanyar madadin, ko ta hanyar mai gyara kuskure; Enclave ya yarda ya yi amfani da shi ne kawai bayan mai amfani yana nan (ID na Fuska, ID na taɓawa ko lambar sirri ta na'urar). ThisDeviceOnly yana nufin madadin iCloud ko iTunes na wayar ba ya ɗauke da maɓalli; wayar da aka dawo da ita ta fara da ɓoye kuma ta nemi fayil ɗin madadin ku da kalmar sirri. Wayar da ba ta da lambar sirri ba za ta iya shiga maɓallin .userPresence ba (Enclave ya ƙi ƙirƙirar ɗaya), kuma na'urar kwaikwayo tana ɗaukar hanya ɗaya ta hanyar ƙira (buƙatar kasancewarta faɗakarwa ce da babu gwajin da zai iya amsawa): a nan maɓallin bayanai abu ne kawai na Keychain na'ura kawai - har yanzu yana cikin kowane madadin, har yanzu ba za a iya karantawa ba yayin da wayar ke kulle, amma ba tare da saƙo na biyu ba - kuma allon Tsaro yana faɗi daidai wannan kuma yana ba da shawarar saita lambar sirri.
Android. Ana naɗe maɓallin bayanai ta hanyar maɓallin AndroidKeyStore AES-256, wanda aka samar a cikin StrongBox lokacin da na'urar ke da ɗaya (in ba haka ba TEE), tare da setUserAuthenticationRequired(gaskiya) da ingancin tabbatarwa na daƙiƙa 30 bayan takardar shaidar biometric ko na'ura, setUnlockedDeviceRequired(gaskiya), da setInvalidatedByBiometricEnrollment(gaskiya) da aka bari. Wannan tutar ƙarshe gaskiya ce maimakon ɗaukar nauyi: Android tana amfani da ita ne kawai ga maɓallan da ke buƙatar takardar shaidar biometric a kowane amfani, don haka a kan wannan maɓallin na daƙiƙa 30 tare da takardar shaidar na'urar ba ta canza komai ba - abin da ke hana yatsan baƙo fita shine cewa yin rijistar mutum yana buƙatar PIN, kuma cire makullin allon yana lalata maɓallin har abada. Ba za a iya fitar da maɓallan Keystore ba kuma an cire su daga madadin girgije na Android. Ana yarda da yanki da app ke sanya suna akan ra'ayoyinsa (webDomain) ne kawai daga wani mai bincike da aka sani; daga kowane fakiti dole ne kuma ya zama wanda tsarin ya tabbatar don wannan fakitin (Digital Asset Links), tunda kowane app zai iya da'awar kowane yanki.
Abin da wannan ke nufi ga fayil ɗin da aka sace a rumbun adana bayanai. Fayil ɗin SQLite da layukan da aka rufe su ne ciphertext. Maɓallin da ke buɗe su yana rayuwa ne a cikin kayan tsaro na wayar kuma fayil ɗin ya fito daga ciki kuma ba za a iya kwafa shi da fayil ɗin ba. Babu abin da za a yi tsammani a layi: maɓallin bayanai bazuwar ne, ba a samo shi daga duk abin da mutum ya zaɓa ba.
3. Fayil ɗin madadin
Ajiye bayanai (backups) su ne abu ɗaya da ke barin wayar, don haka su ne wuri ɗaya da ake iya samun harin da ba a haɗa shi da intanet ba a ƙa'ida. Tsarin ya sa harin ya yi tsada kuma ba shi da amfani sosai kamar yadda zai yiwu:
- Kalmar sirrin aƙalla haruffa 12 ne (takardar ta ƙi ƙima kuma tana nuna sandar ƙarfi).
- Babu wata alamar kalmar sirri da aka adana a ko'ina, a cikin fayil ɗin ko a cikin app ɗin.
- Sabon gishiri mai girman byte 16 da kuma nonce mai girman byte 12 ga kowane fayil da aka rubuta.
- Duk jikin yana da AES-256-GCM, don haka kalmar sirri da ba daidai ba ko fayil ɗin da ya lalace ana ƙin yarda da shi, ba a taɓa ɓoye shi zuwa shara ba.
- Ana ɗaure kan rubutun (tsari, sigar, sigogin KDF, gishiri) cikin alamar GCM azaman ƙarin ingantattun bayanai, don haka fayil ɗin da aka gyara aikin sa ba ya buɗewa.
Fayil ɗin JSON ne kuma ana iya karantawa a cikin kowane editan rubutu; rubutu ne kawai ba ya bayyana. Duk wanda ya sami fayil ɗin cikin shekaru biyar, bayan an tafi da app ɗin, zai iya ganin daidai yadda aka rufe shi kuma ya buɗe shi da OpenSSL ko kowane ɗakin karatu na Argon2.
Tsarin v1 (an aika shi cikin 1.0, yana ci gaba da karantawa)
{
"format": "authbackup",
"version": 1,
"kdf": "PBKDF2-HMAC-SHA256",
"rounds": 600000,
"salt": "<base64, 16 bytes>",
"cipher": "AES-256-GCM",
"nonce": "<base64, 12 bytes>",
"ciphertext": "<base64>",
"tag": "<base64, 16 bytes>"
}| Mataki | Bytes |
|---|---|
key | PBKDF2-HMAC-SHA256(passphrase as UTF-8, salt, 600000 rounds, 32 bytes) |
aad | UTF-8("authbackup:1:600000:") ‖ salt (bayanan gishiri marasa amfani, ba tushe64 ba) |
ciphertext, tag | AES-256-GCM(key, nonce, plaintext, aad); alamar bytes 16, an adana daban |
plaintext | UTF-8 JSON, an tsara maɓallai: {"accounts":[…],"exportedAt":"…Z","passwords":[…],"version":1} |
Bayanin jituwa: Android 1.0 ta rubuta wani nau'in v1 — kdf a ƙaramin harafi, babu maɓallin tag (alamar byte 16 da aka haɗa zuwa ciphertext), babu ƙarin bayanai. Duk dandamali biyu suna ci gaba da karanta waɗannan fayilolin (idan alamar ba ta nan: raba byte 16 na ƙarshe, buɗe da AAD mara komai; kwatanta kdf case-ba tare da damuwa ba) kuma duka biyun yanzu suna rubuta tsarin da ke sama kawai.
Tsarin v2 (na yanzu; tsoho don sabbin madadin bayanai)
{
"format": "authbackup",
"version": 2,
"kdf": "Argon2id",
"memoryKiB": 65536,
"passes": 3,
"lanes": 1,
"salt": "<base64, 16 bytes>",
"cipher": "AES-256-GCM",
"nonce": "<base64, 12 bytes>",
"ciphertext": "<base64>",
"tag": "<base64, 16 bytes>"
}| Mataki | Bytes |
|---|---|
key | Argon2id(version 0x13, passphrase as UTF-8, salt, m = 65536 KiB, t = 3, p = 1, tagLength 32, no secret, no associated data) |
aad | UTF-8("authbackup:2:argon2id:65536:3:1:") ‖ salt |
ciphertext, tag | AES-256-GCM(key, nonce, plaintext, aad); alamar bytes 16, an adana daban |
plaintext | UTF-8 JSON, an tsara maɓallai: {"accounts":[…],"cards":[…],"exportedAt":"…Z","passwords":[…],"version":2} |
Argon2id shine tsarin aiwatar da C na asali (phc-winner-argon2, CC0), wanda aka sayar a duka dandamali biyu. 64 MiB da wucewa 3 suna ɗaukar kimanin daƙiƙa ɗaya akan wayar da ke yanzu kuma yana sa kowace ƙima ta kashe wannan ƙwaƙwalwar ajiya da lokaci akan kowace na'ura - kadarar PBKDF2 ba ta da ita akan na'urorin GPU, kuma dalilin da yasa v2 ke wanzuwa. Mai karatu yana watsi da maɓallan da bai sani ba, don haka mai karatu na v1 wanda aka ba shi jikin v2 kawai ba ya ganin katunan.
Shaida
Fayilolin gwaji guda uku (madadin v1, madadin v2 da Argon2id) ana samar da su ta hanyar aiwatarwa ta uku, ba tare da la'akari da manhajojin biyu ba (OpenSSL na Node don PBKDF2 da AES-GCM, WebAssembly Argon2id da aka duba a lokacin samarwa bisa ga amsoshin da aka buga na aiwatar da tunani). Kowannensu yana riƙe da kalmar sirri, gishiri, nonce, plaintext, derived key, AAD, ana tsammanin ciphertext da tag, da kuma cikakken fayil ɗin. Na'urar tana gwada fayiloli iri ɗaya kuma tana tabbatar da byte iri ɗaya - don haka an tabbatar da cewa madadin da aka rufe akan dandamali ɗaya, ba a ɗauka ba, zai buɗe a ɗayan, kuma yarjejeniyar duka ukun ba kwafi biyu na kuskure iri ɗaya ba ne. Kayan aiki na abokin aiki yana buɗe fayil ɗin da wayar ta rubuta da wannan tsari na uku kuma yana duba kanun labarai akan ƙa'idodin da ke sama (daidai maɓallan tsarin, don haka babu wata alama ko suna da za a iya samu; gishirin byte 16, nonce byte 12, alamar byte 16 da aka adana daban; sigar 2 a daidai 64 MiB / 3 / 1; kalmar sirri da ba daidai ba ta ƙi); gudu ta atomatik ta iOS yana rubuta ɗaya akan na'urar kwaikwayo kuma yana buɗe shi ta wannan hanyar, kuma yana bincika akwatin app na na'urar kwaikwayo, akwatin App Group da bayanan maɓalli don kowane kalmar sirri da lambar katin da aka yi amfani da ita azaman UTF-8 da UTF-16 (buga 0).
4. Tsarin Barazana
| Yanayi | Abin da suke da shi | Abin da suka samu |
|---|---|---|
| Wayar da ta ɓace ko ta sata, a kulle | Abin da suke da shiNa'urar, fayil ɗin bayanai, layukan da aka rufe | Abin da suka samuRubutun Sirri. Maɓallin naɗewa yana cikin Secure Enclave / StrongBox kuma yana fitowa ne kawai bayan an kulle na'urar tare da sabon lambar sirri ko lambar sirri. Goge wayar daga nesa (Nemo Na'urata/Nemo Na'urata) yana lalata maɓallan da shi. |
| Fayil ɗin madadin da aka sace | Abin da suke da shiFayil ɗin .authbackup daga asusun girgije, imel, ko kwamfutar tafi-da-gidanka | Abin da suka samuJikin AES-256-GCM a ƙarƙashin maɓalli da aka samo daga kalmar sirri mai aƙalla haruffa 12, tare da gishirin kowane fayil da Argon2id a 64 MiB × 3 wucewa (v2) ko PBKDF2 a zagaye 600,000 (v1). Babu wata alama, babu sunan mai amfani, babu jerin asusu a bayyane. Kowane zato yana kashe cikakken samowa; babu gajeriyar hanya. Kalmomin sirri masu ƙarfi sune duk kariya a nan, kuma app ɗin ya faɗi haka a kan takardar. |
| Na'urar da aka sata tare da allon a buɗe | Abin da suke da shiWaya a hannunka, a buɗe take | Abin da suka samuJerin Lambobi. Wurin ajiyar bayanai (kalmomin sirri, katunan) yana bayan makullin manhajar kuma yana sake kullewa akan ma'aunin kulle ta atomatik (nan take / minti 1 / minti 5); ƙimar da aka warware tana wanzuwa ne kawai a cikin ƙwaƙwalwar ajiya yayin da allonta ke nuna ta. Cika ta atomatik da fitarwa ta rubutu mai sauƙi suna neman sabon biometric koda lokacin da manhajar ke buɗe. Kunna makullin manhajar da "Nan take" idan wannan shine yanayin da kuke damuwa da shi. |
| Manhajar mugunta a waya ɗaya | Abin da suke da shiSandbox na wani manhaja, allon rubutu, dabarun samun dama ko rufewa | Abin da suka samuBa zai iya karanta fayilolinmu ba (sandboxing na dandamali) ko amfani da maɓallinmu (maɓallin yana da alaƙa da asalin sa hannunmu da kuma kasancewar mai amfani). Kwafi yana sharewa daga allon rubutu bayan daƙiƙa 30; akan Android an yi wa kwafin alama mai mahimmanci kuma an cire shi daga tarihin allon rubutu. An saita allon ajiya na FLAG_SECURE akan Android (babu hotunan kariyar kwamfuta, babu rikodin allo, babu komai a cikin maɓallin kunnawa); iOS yana ɓoye ƙaramin ƙaramin maɓallin kunnawa. Cika atomatik akan Android ana ba da shi ne kawai ga manhajojin da tsarin ya tabbatar akan yankin da aka adana (Haɗin Haɗin Kayayyakin Dijital), don haka ba a ba da app mai kama da juna kalmar sirrinku ba. |
| Shafin phishing | Abin da suke da shiShafin da yayi kama da wanda ka adana | Abin da suka samuBabu wani abu da ke cikewa. Daidaitawa ana yin ta ne ta hanyar yankin da za a iya yin rijista (jerin ƙarin bayani na jama'a, an haɗa shi kuma an sabunta shi da app ɗin): login.example.com da example.com sun dace, example.com.evil.net da examp1e.com ba sa yi. Mai binciken da ke cikin manhajar yana daidai da wannan hanyar kuma yana cikewa ne kawai a cikin firam ɗin da ya tambaya, an sake duba shi akan asalin firam ɗin a lokacin cikawa; mai masaukin baki wanda ba shi da yankin da za a iya yin rijista nasa - adireshin IP, suna mara komai akan hanyar sadarwar gida - ya dace daidai kuma babu abin da ya ɓace. iOS AutoFill yana ƙara duba yankin da ke da alaƙa da Apple. Kalmar sirri da dole ne ku liƙa da hannu a cikin kamannin har yanzu haɗari ne; manhajar ba za ta iya cire hakan ba, kawai ku guji taimakawa. |
| Sabobinmu na kanmu | Abin da suke da shi— | Abin da suka samuBabu uwar garken ajiya. AssuredAuth ba shi da asusu, babu shiga ko kwafin rumbun ajiyar ku, don haka babu wani abu naku a gefenmu da za a sace ko a fashe. Abubuwa biyu suna aiki a gefen uwar garken, babu ɗaya daga cikinsu da ya taɓa rumbun ajiyar: akwatin gidan waya na relay don faɗaɗa tebur, wanda ke adana ambulan da aka ɓoye daga ƙarshe zuwa ƙarshe (lambobin lokaci ɗaya, an goge su lokacin da aka karanta; relay ba ya taɓa samun maɓalli), da kuma sabar fita na haɗin kai na zaɓi, waɗanda ke ɗauke da zirga-zirga kuma ba sa adana bayanan shiga. |
| Saƙo ko buƙatar gwamnati | Abin da suke da shiTsarin shari'a da aka yi mana | Abin da suka samuBabu abin da za a miƙa mana: ba mu da rumbun ajiya, babu maɓalli, babu kalmar sirri ko kuma babu madadin ajiya. Za a iya tilasta mana mu faɗi haka; ba za a iya tilasta mana mu samar da abin da babu shi ba. |
5. Allon allo, hotunan kariyar kwamfuta da ƙwaƙwalwar ajiya
- Kwafi yana sanya ƙimar a kan allo na tsawon daƙiƙa 30, sannan ya share shi idan har yanzu namu ne. A kan Android, hoton yana da alamar EXTRA_IS_SENSITIVE don haka tsarin yana ɓoye shi daga samfoti na allo da tarihin allo; akan iOS, abun pasteboard na gida ne kawai (ba a saka shi a wasu na'urori ba).
- Allon Vault (Kalmomin Sirri, Kalmar Sirri, Katuna, Kati, takardun kalmomin shiga, fitar da rubutu a sarari) an saita su FLAG_SECURE akan Android. iOS ba shi da alamar da ta yi daidai; app ɗin yana ɓoye ƙaramin hotonsa a cikin mai sauya app kuma ƙimar tana bayan maɓallin ido ta tsohuwa.
- Ƙimar da aka cire ɓoyewa tana rayuwa ne kawai a cikin ƙwaƙwalwar ajiya yayin da allo ke nuna su kuma ana sauke su lokacin da ya ɓace ko kuma aikace-aikacen ya kulle. Ana buɗe maɓallin bayanai don buƙata kuma ba a adana shi a cikin makullin ba.
- Fitar da rubutu mara rubutu yana nan (don haka koyaushe zaka iya barin) kuma yana bayan takardar tabbatarwa da sabon tsarin biometric, kuma allon sa shima FLAG_SECURE ne.
6. Cika ta atomatik: abin da ke cikawa, da abin da ba ya cikawa
| Ina | Kalmomin sirri | Katuna |
|---|---|---|
| iOS: Safari da manhajoji (Tsarin Cika Kai Tsaye) | Kalmomin sirriEe, bayan sabon ID na Fuskar fuska / ID na taɓawa / lambar wucewa a cikin tsawo (LAContext), kuma kawai don yankin da za a iya yin rijista an adana shigarwar, tare da duba yankuna masu alaƙa da Apple don aikace-aikace | KatunaA'a. Cika katin ta atomatik a Safari na Apple ne kawai; allon katin yana cewa "Yana cike burauzar AssuredAuth da Kwafi" kuma yana alƙawarin babu wani abu makamancin haka. |
| Android: manhajoji da Chrome (AutofillService) | Kalmomin sirriEe, tabbatar da daidaiton bayanai: tsarin yana nuna BiometricPrompt kafin cikawa; fakitin app ɗin ya dace ne kawai lokacin da Digital Asset Links ya haɗa shi da yankin da aka adana | KatunaEe, alamun creditCardNumber, creditCardExpiration* da creditCardSecurityCode, ƙofar biometric iri ɗaya |
| Mai binciken AssuredAuth (dandamali biyu) | Kalmomin sirriEh, ta hanyar yankin da za a iya yin rijista - mai masaukin baki wanda babu wanda ya dace da shi daidai - a cikin firam ɗin da ya tambaya, biometric kafin cikar | KatunaEh, ta hanyar gano filin, biometric kafin cikar |
| Kwafi maɓallan | Kalmomin sirriA bayan makullin app, allo mai ɗaukar hoto na daƙiƙa 30 | KatunaLamba, ƙarewa, CVC (ƙa'idodi iri ɗaya) |
Babu abin da ke cika mai masaukin baki mai kama da wanda ke cike da shi. Babu abin da ke cika ba tare da biometric ba.
7. Abin da ba ya taɓa faruwa
Babu uwar garken ajiya. Babu wani nazari da ke ɗauke da filin ajiya. Babu fitarwa ta rubutu mai sauƙi ba tare da takardar tabbatarwa da sabon biometric ba. Babu SDK na ɓangare na uku da aka ɗora a allon ajiya. Babu hoton allo na ajiya. Babu alamar kalmar sirri. Babu rajistar ƙima, a cikin kowane gini.
8. Abin da ba za mu iya karewa daga gare shi ba
Kalmar sirri mai rauni da za a iya tsammani. Wayar da tsarin aiki ke cikin matsala a tushen (na'urar jailbroken ko rooted na iya yin ƙarya ga app game da duk abin da ke sama). Mutumin da ake kallo yayin bugawa. Malware akan tebur da kake liƙawa. Mun faɗi haka ne don a karanta jerin da ke sama don abin da yake: abubuwan da ƙira za ta iya cirewa, cirewa.
9. Matsayin bita
An gwada wannan ƙirar a kan raka'a ɗaya idan aka kwatanta da amsoshin da aka buga a kan dandamali biyu da kuma nasa vectors na dandamali. Ana yin bita ta waje a cikin jerin masu shi kafin a tallata rumbun ajiya a cikin jerin shagon; har sai ya faru, wannan takarda za ta faɗi haka a nan.
10. Inda abubuwa ke gudana
Babu wani abu da ya fita daga cikin rumbun ajiyar wayar, amma wasu abubuwa kaɗan ne ke gudana a kan na'urorin wasu. Wannan shine jerin, da kuma abin da kowannensu ke ɗauke da shi; bayanan da ke gudana da kansu an bayyana su a cikin manufar sirri a https://assuredauth.com/privacy.
- Google Cloud / Firebase — akwatin saƙon aikawa don faɗaɗa tebur (ambulan da aka ɓoye daga ƙarshe zuwa ƙarshe, an goge su lokacin da aka karanta), alamun turawa, yanayin siye, da saƙonnin da aka aika ta hanyar fom ɗin tuntuɓar.
- Vercel — tabbatar da cewa.com ne, shafukansa da ƙananan ayyukan da ke bayansu.
- Vultr — sabar fita ta haɗin kai na sirri. Zirga-zirga tana ratsa su; babu abin da aka adana.
- Apple da Google Play — sayayya da biyan kuɗi, a cikin shagunansu.
- PostHog - nazarin samfura: ƙidayar abin da ake amfani da shi, wanda aka haɗa shi da babu asali.
- RevenueCat - yanayin biyan kuɗi: aiki ko ƙarewa, da kuma akan wane shiri.
Kowannensu yana riƙe da abin da layinsa ya ce amma babu komai daga cikin rumbun ajiyar. Jerin yana canzawa lokacin da samfurin ya yi, kuma wannan ɓangaren yana canzawa da shi.
Bayar da rahoton rauni
Idan kana ganin ka sami rauni a duk wani abu da aka bayyana a nan, rubuta zuwa hello@assuredauth.com tare da taken "Tsaro". Da fatan za a haɗa da dandamali, sigar app ɗin da matakan; shaidar da ke amfani da bayananka ya isa, kuma muna roƙon kada ka gwada da na wasu mutane. Ba mu bayar da maɓallin PGP ba; idan rahoto bai kamata ya yi tafiya a cikin imel ba, faɗi haka a cikin saƙon farko kuma za mu shirya wata hanya.
Abin da muka yi alkawari a madadin haka: muna amincewa cikin kwanaki uku na kasuwanci, muna sanar da ku yayin da muke aiki a kai, muna gyara abin da ke gaskiya kafin a buga wani abu game da shi, kuma muna yaba muku a nan idan kuna son a yaba muku. Ba za mu ɗauki matakin shari'a kan binciken da aka yi da gaskiya a cikin iyakokin da ke ƙasa ba.
A takaice: manhajojin iOS da Android, manhajojin agogo, fadada tebur, tabbatar da cewa suna aiki da API ɗinsu. Ba a cika yin amfani da su ba: App Store da Google Play da kansu, masu samar da kayayyaki da aka lissafa a sama, injiniyan zamantakewa na kowa, da kuma hana yin aiki da su.
Babu wani lada a wannan lokacin. Ana amsa rahoto da gyara da kuma godiya, ba da kuɗi ba.