Security Information
Rynci runs locally and does not upload source code or diagnostic history to a hosted Rynci account. Remote GitHub API queries go directly to GitHub when you request them.
Local execution
rynci replay previews a plan by default. Adding --execute permits supported GitHub Actions workflow code to run via Docker and act. Docker is not a complete isolation boundary. For untrusted workflows, use an isolated disposable VM with no production credentials.
Licensing
License tokens are signed using Ed25519; the CLI contains a public verification key, not the merchant's signing key. Once activated, local license verification requires no recurring server access. Stripe processes the one-time purchase. The purchased license is displayed directly on a payment-verified page. The customer may download the registration text file; Rynci does not send outgoing email.
Downloads and dependencies
Compare checksums in SHA256SUMS.txt. Source-based evaluation installation requires Python dependencies from their package registries. Native executable signing and notarization are separate release prerequisites.
Report a security issue
Email the private support form with a concise summary. Please do not post sensitive exploit details or private credentials publicly.