How connections are secured

Your phone talks to your computer through RepoGo's relay. The connection is encrypted end to end: your phone and your computer hold the keys, and the relay only passes along bytes it can't read. This page explains how, and what the relay can and can't see.

The short version#

• Your computer dials out to the relay and keeps a line open. Nothing on your network listens for connections.
• Your phone connects to your computer's name on the relay. The relay reads that name and nothing else.
• The relay joins the two lines. Your phone and your computer then run TLS 1.3 directly with each other, through the relay, like a phone call put through by a switchboard.
• Your phone checks your computer's certificate against the one it saved when it paired, not against a certificate authority.

Step by step#

1. Your computer connects out. The host keeps a connection to h.repogo.app and proves which computer it is with its own key. The relay ends TLS for this connection only, with an ordinary certificate for h.repogo.app.
2. Your phone asks for your computer. It opens a TLS connection to <your computer's id>.h.repogo.app. The relay reads the name from the start of the handshake (the SNI), the same part any network can see.
3. The relay joins them. It tells your computer a phone is waiting and pipes the two connections together. From here it copies bytes in both directions without opening them.
4. Your phone and computer shake hands. Your computer presents its own certificate. Your phone accepts it only if its key matches the pin saved at pairing, signed by your computer's identity.
5. Your phone signs in. It signs a challenge with its own key. The signature is bound to this TLS session, so it can't be replayed on another connection. Your computer checks it against the devices you've paired.

Only then does anything about your chats, code or files go over the connection.

Encryption#

• TLS 1.3 on both ends, Apple's Network framework on the phone and Go's standard library on your computer. Nothing older is accepted.
• Hybrid post-quantum key exchange. Connections agree their keys with X25519 combined with ML-KEM-768, so traffic recorded today stays protected even against a future quantum computer.
• Your computer's certificate is its own. The host makes a TLS key the first time it runs and keeps it on your computer. No certificate authority is involved, so none can issue a certificate that your phone would accept for your computer.

Device signatures (step 5 and pairing) use classical keys, Ed25519 and P-256, as TLS certificates do today.

Keys#

• Your phone's key is made in the Secure Enclave and can't be copied off the device, even with full access to the phone's storage. A phone that paired before this can move its key from the Keychain into the Secure Enclave without pairing again: open the environment in Settings → Environments and tap Move to Secure Enclave under Connection.
• Your computer's keys live in the host's folder on your computer: one identity key and one TLS key, readable only by your user.
• If your computer's TLS key might have leaked, npx @repogo/host tls rotate replaces it. No phone trusts the new key, so pair each device again afterwards.

Pairing#

• Pairing shows a code on your computer, as text, a QR code and a link.
• The invite inside it holds your computer's id, its public key and its signed TLS pin. It's encrypted with the code before it's stored on repogo.app, and repogo.app only gets a hash of the code, so it can't read the invite.
• An invite lasts a couple of minutes. Starting a pairing only works on the computer itself; a paired phone can't add more devices on its own.

What the relay can see#

• Which computer each phone connects to, and when.
• IP addresses, and how much data passes and when.

It can't see your chats, code, files, terminal or anything else you send. It never holds a key that could decrypt them.

Opening a project runs nothing#

Plugins run only from ~/.repogo/plugins on your computer, folders you put there yourself. A project can ship pages that call those plugins, but never plugin code: opening or cloning a repo doesn't make your computer run anything in it.

Limits#

• Notifications and Live Activities go through RepoGo's relay to Apple: your computer sends them on its connection to h.repogo.app, which holds the key Apple requires. Alerts about chats use fixed wording, such as "Approval needed". Plugin notifications and reminders carry the text they were given, and Live Activities show a chat's title and progress.
• Older computers need an updated host: phones reach a computer only through h.repogo.app. Run npx @repogo/host update. A phone that paired with a host older than 0.1.42 may need to pair again after the update.

Read the code#

The host and the relay are in github.com/repogoapp/host, so you can check everything on this page against what runs.