Security & privacy
Small privileged surface. Nothing leaves your PC.
A disk tool needs deep access to your drives. Strata keeps that access in one small, verified process, checks every delete several times over, and sends nothing about your files anywhere.
- UINever elevatedProcess model
- PipeYou and SYSTEM onlyHelper pipe
- DeletesFail closedDelete checks
- NetworkNo telemetryPrivacy
01Process model
The window never runs as administrator.
An elevated web runtime would widen the attack surface and break drag-and-drop from Explorer. So the app stays unelevated, and only the work that truly needs administrator rights runs in a separate helper.
The helper trusts nothing it is told
The pipe proves who is talking; the helper still validates what is asked. A delete is accepted only as a volume, file id, expected path, expected size and expected modification time, and is checked again against the helper’s own copy of the never-delete list.
Least privilege, even when elevated
At start the helper drops every privilege except the three it needs, and enables backup and volume rights only while a volume is being opened. Deletes run with ordinary administrator access checks, so a file that denies administrators stays undeletable.
Declining is always safe
If you say no to the UAC prompt, Strata uses its standard scanner. Optional service mode serves only the configured app image run by a local administrator, and stops after 5 idle minutes.
What needs administrator rights
| Capability | Administrator | Why |
|---|---|---|
| Standard scan (directory walk) | No | Ordinary directory listings and attribute-only opens |
| Classification, search, history, all views | No | Run on the in-memory index |
| Cleanup of your own files (Recycle Bin or permanent) | No | Ordinary delete rights |
| Restore from the Recycle Bin | No | Moves your own Recycle Bin entries back |
| Fast scan (raw MFT read) | Yes | Opening a volume device (\\.\C:) for raw reads requires administrator rights |
| Live updates on NTFS (USN change journal) | Yes | Reading the journal and re-reading changed MFT records needs a volume handle |
| Activity tracking (ETW) | Yes | Windows lets only administrators start kernel trace sessions |
| Privileged deletes, delete on next restart | Yes | Items your account cannot delete, and MOVEFILE_DELAY_UNTIL_REBOOT |
| Shadow copy totals ("System Restore / Shadow copies") | Yes | The VSS WMI provider (Win32_ShadowStorage) refuses unelevated queries |
| Complete scans of other users' profiles | Yes | Their folders deny access to your account |
| DISM component cleanup | Yes | DISM /Online requires administrator rights |
| Service mode | Yes, to install | Installs the helper as an on-demand Windows service so fast scans need no UAC prompt per launch. Only accounts that are local administrators can use it |
02Helper pipe
A pipe only you can open, to a helper that proves who it is.
Before either side parses a single byte, each checks the other’s identity with the kernel and with Windows code signing. Then they agree on a protocol version, or hang up.
- Name
Random per launch: your user SID plus 128 bits from
BCryptGenRandom, passed on the helper’s command line. - Creation
First-instance only, so a squatted name fails; remote clients rejected; one instance per pipe.
- DACL
You get read and write only, with no create-instance or permission changes; SYSTEM gets full access; owner rights are limited to reading the descriptor.
- Integrity
An explicit medium label with no-write-up: the app can connect, low-integrity and AppContainer processes cannot.
- Peer check
Client process id from the kernel, then image path, start time and Authenticode signer, which must match the helper’s own. The app verifies the helper the same way.
- Framing
Every message is one length-prefixed frame capped at 64 MiB; the length is checked before anything is allocated, and any framing error closes the connection.
- Rate limit
A token bucket per connection: bursts of 200, 100 requests a second sustained.
03Before every delete
Seven checks, any of which can say no.
Deletion is the only destructive operation in Strata, and every layer fails closed: when a check cannot prove an item is the one you confirmed, the item is left alone.
- 01
Never-delete list
In code and independent of rule packs: volume roots, the Windows folder, Program Files and
WindowsApps, every profile root, known-folder roots, boot, paging and hibernation files, NTFS metadata and Strata itself. Enforced by the app and again by the helper. - 02
Every spelling
\\?\,\??\, UNC and administrative shares, volume GUID and device paths with every mount point, trailing dots and spaces, and 8.3 short names. - 03
Handle checks
Opened without following reparse points, its resolved path checked again, and its volume serial, file id, size and modification time matched against the scan.
- 04
Recycle Bin
Moved through the Shell with every ancestor held open, so none can be swapped for a junction mid-operation. Anything the Shell would delete permanently is aborted.
- 05
Pre-flight
Items that can’t be recycled (no Recycle Bin, too large, path too long) are listed before anything happens, and need a separate permanent-delete confirmation.
- 06
Locks
Restart Manager names the program holding a file. Closing it is a polite request after you agree, never a kill.
- 07
Write-ahead log
A record is committed before each item is touched and completed after. If Strata stops mid-way, the next launch marks the entry as interrupted.
04Updates and downloads
Signed updates. Checkable downloads.
Installed copies only install updates signed with the project’s release key, and every installer you download by hand comes with a published SHA-256 checksum.
Signed update manifests
The app reads a small manifest, latest.json, from GitHub Releases. Each installer it lists carries a signature, and the app checks it against the public key built into Strata before installing. An update that fails to verify is never run.
If a just-installed update fails to start, Strata offers to reinstall the previous version, which is verified the same way.
SHA-256 checksums
Every release publishes SHA256SUMS.txt beside its installers; the releases page and the download section show them with a copy button. To check a download in PowerShell:
Get-FileHash .\Strata_0.1.0_x64-setup.exe -Algorithm SHA256The installers aren’t code-signed yet, so Windows SmartScreen may ask you to confirm (More info → Run anyway).
05Privacy
No telemetry. Here is every request the app makes.
Scan results, file names and paths never leave your machine. This is the complete list of network requests, taken from the privacy document in the repository.
| Request | When | What is sent |
|---|---|---|
| Update check | 20 seconds after launch, then daily, in release builds configured with an updater key | A request to GitHub for the release manifest (latest.json). No identifiers, scan data or paths |
| Update download | When a newer release is found | The signed installer is downloaded from GitHub Releases and installs when you exit Strata |
| Rollback | Only if a just-installed update fails to start and you confirm the prompt | The previous version's manifest and installer are downloaded from GitHub Releases |
| WebView2 bootstrapper | During installation, only if the WebView2 Runtime is missing | Microsoft's bootstrapper downloads the runtime from Microsoft |
Report an issue (in Settings) opens a new GitHub issue in your browser, pre-filled with the Strata version, Windows build and architecture. Strata itself sends nothing; you review and submit the issue yourself, and it never includes paths or file names.
Nothing else in Strata makes network requests. The signature checks between the app and its helper run without revocation checking, so they never contact certificate servers. Scanning a network share you enable reads that share, as any file browser would.
What Strata stores, and where
| Data | Location | Contents |
|---|---|---|
state.db | store\ | Settings, and the undo/audit log of every cleanup (paths, sizes, method, time) that Recycle Bin restores depend on |
history.db | store\ | Folder-size snapshots over time, activity tracking data (if enabled), the duplicate finder's hash cache |
<volume serial>.idx | index\ | The last index of each scanned volume (the names, sizes and times of its files and folders), so it opens at once and catches up with changes at the next launch |
update-state.json | the folder itself | Version numbers of the last installed update, used to offer a rollback |
| WebView2 profile | the folder itself | The embedded browser's own data. The UI is bundled with the app; no remote web content is loaded |
| User rule packs | Your user rules folder (Settings → Rules) | Rule packs you write yourself |
Everything can be cleared from Settings → Data & privacy, or removed with the uninstaller. Full details in docs/PRIVACY.md.
06Report a vulnerability
Found something? Tell us privately.
Report privately through GitHub: Security → Report a vulnerability. Please don't open a public issue for a vulnerability.
Include the affected component, steps to reproduce, and the impact you expect. A minimal proof of concept helps.
Scope
The parts where a bug matters most:
- The elevated helper (
strata-helper): anything that lets an unelevated or untrusted process make it read, write or delete what the user couldn't. - The named pipe (
strata-ipc): bypassing the DACL, integrity label, peer signature check, handshake or rate limit; pipe-name squatting; malformed frames that crash or confuse either end. - Deletion safety (
strata-clean): any path, spelling, link, junction, mount point or race that gets past the never-delete list or pre-flight re-verification, or deletes something other than what the user confirmed. - Parsers (
strata-ntfs, rule packs, cache files): panics, hangs or memory blowups on malformed input.
Out of scope: issues that need an attacker who already has administrator rights, and unsigned local builds you made yourself.