Limits and open items

What easysync does not do, what is not finished, and what has not been checked yet.

easysync has not had an independent security review.

The desktop programs have a first release for Windows and Linux; its files are unsigned. The Android app is in Google Play.

Not checked by anyone else #

An independent security review, in particular of the pairing construction and of the key handling, is still open. Do not rely on easysync for anything that needs that assurance.

What has been tried #

Windows (Desktop app and command line): Tested by hand. The command line and daemon were run on Windows 11 in the project's tests (pairing, clipboard text, files, revoking a device). The maintainer tested the desktop app by hand (statement of 2026-10-27); no further detail of this test is recorded, and it is not the acceptance run. The installer is unsigned, and the Windows 11 part of the acceptance run is still open.
macOS (Desktop app and command line): Not tested. The desktop app is built and its installer is unsigned. It has never been run on a Mac, and the project's pipeline has no macOS build runner so far.
Linux (Command line, daemon and desktop app): Tested by hand. The maintainer tested the desktop app by hand (statement of 2026-10-27). Pairing and file transfers (directly and through a relay) were also run between two daemons, and the desktop app passed its automated tests. The Linux desktop app is outside the acceptance criteria of the first release.
Android (App): Tested by hand. The app is built and passed unit and component tests. The maintainer tested it by hand (statement of 2026-10-27); no further detail of this test is recorded. Runs on an emulator and on more devices are still open. The app is in Google Play.
iOS (App): Not started. There is no iOS app yet. It needs a Mac for building and testing.
Web app (Runs in the browser): Tested by hand in all browsers except Safari; Safari not tested. A browser cannot connect directly, so the web app always uses the relay. The maintainer tested it by hand in all browsers except Safari (statement of 2026-10-27); no browsers or versions are recorded, and Safari is not tested. Automated browser tests ran in headless Chromium, Firefox and WebKitGTK on Linux.

Things easysync does not do #

No key backup and no migration. The identity of a device cannot be exported. A device that is reinstalled adopts the keys that survived. A lost identity is replaced by a reset and new pairings.
Revocation is local. It is not passed on to other devices.
No history. Clipboard text is not kept, and text is not queued for devices that are off.
No cleaning of received text. See Clipboard sync.
No folders. A transfer is one regular file.
No direct connection through every network. easysync does not punch through routers. The relay is the fallback.
No control of the host of the web app. See The web app and its limits.
Not anonymous. easysync does not hide who talks to whom and when. See What the relay sees.

Smaller limits #

When the same hourly value of the local announcement is seen on several networks, a device can be recognised on them.
A relay session ends after the relay's session lifetime, one hour by default. Transfers continue by themselves.
A crashed process leaves its memory to the operating system. easysync switches off core dumps on Linux, Android, macOS and iOS. On Windows that protection is not in place in this version.

Sources: implementation plan (Progress at a glance).