Security
A small attack surface, on purpose.
MDSyntax has no server, no account and no document upload path, which removes most of the categories a security review would otherwise have to worry about. What remains is the desktop application itself — how it renders untrusted files, what it is allowed to reach, and how it is signed. This page documents all of it.
Documents
Local only
Never transmitted
Accounts
None
No credentials to steal
Outbound
Two calls
Both user-initiated
Application hardening
MDSyntax is an Electron application, configured against the recommended hardening checklist for that platform:
- Context isolation on, node integration off. The window that renders your documents has no direct access to Node or the filesystem. It talks to the privileged process only through a narrow, explicitly enumerated preload bridge.
- Navigation is locked down. The app window cannot be navigated to a remote origin, and attempts to open new windows are intercepted and handed to your default browser rather than rendered in-app.
- A content security policy restricts what a rendered document may load. Remote scripts and remote resources referenced by untrusted content are blocked.
- Markdown output is sanitised with DOMPurify before it reaches the DOM, so a malicious document cannot inject script through a Markdown or HTML construct.
- HTML previews are sandboxed and served from a dedicated local protocol rather than the app's own origin, and the status strip always shows the exact URL being previewed.
Filesystem access
MDSyntax reads only the files you open and the folders you explicitly add to the Library. It writes only where you tell it to: the file you are editing, and the destination you pick when exporting. On macOS the app declares usage descriptions for the Documents, Desktop and Downloads folders, so the operating system prompts you before it may read them.
The Mac App Store build runs inside Apple's App Sandbox, using security-scoped bookmarks so that watched folders survive a relaunch without granting broader access. That sandbox also forbids running external binaries, which is why the Git panel and the iCloud download action are absent from that edition.
Network behaviour
The application initiates two kinds of outbound request, both over TLS, and both only because you asked for them:
| Licence check | To our licensing provider, carrying the licence key and a randomly generated activation identifier — not a hardware fingerprint. No document data. Fails soft into a 30-day offline grace period. The Mac App Store build makes no licence request at all; entitlement there runs through Apple's own in-app purchase system. |
|---|---|
| New from URL | Directly to the address you typed, from your machine. Not proxied through us. We are never told it happened. |
Everything else — parsing, syntax highlighting, diagram rendering, math typesetting, PDF and Word generation — happens entirely offline, inside the application. You can block MDSyntax at the firewall and lose nothing but licence re-validation and URL import.
Code signing and distribution integrity
- macOS direct download. Signed with an Apple Developer ID certificate, built with the hardened runtime, and notarised by Apple. Gatekeeper verifies it on first launch.You can confirm this yourself with
spctl -a -vvv -t install /Applications/MDSyntax.app. - Mac App Store. Signed and reviewed by Apple, distributed only through the Store.
- Microsoft Store. The package is signed by Microsoft on ingestion and installed through the Store's own trusted pipeline.
- Windows direct download. Not currently code-signed — we have not yet bought an Authenticode certificate, so Windows SmartScreen will warn you and the UAC prompt will show an unknown publisher. Verify the SHA-256 checksum on the download page before running it, or install from the Microsoft Store, where Microsoft signs the package itself.
Download MDSyntax only from mdsyntax.com or an official store listing. We publish a SHA-256 checksum beside every direct download; if a build's signature or checksum does not match, do not install it — tell us instead.
Dependencies
We track advisories against our dependency tree, including Electron and Chromium themselves, and ship an updated build when a relevant vulnerability is disclosed. Because Electron bundles its own Chromium, a browser-level fix reaches you through an application update rather than an operating-system one — which is why the app checks for updates automatically and why we keep the cadence short.
Your data, your risk profile
Because nothing is stored on our side, the security of your documents is the security of your machine. Full-disk encryption, a screen lock and current OS updates protect your MDSyntax content exactly as they protect everything else. Local version-history snapshots and unsaved drafts live in the app's support directory under your user account — remember that if you are handing the machine on.
Reporting a vulnerability
Email [email protected] with the subject line SECURITY. Include the version, platform, reproduction steps and what an attacker gains. Please do not open a public issue first.
- We acknowledge within 3 business days.
- We aim to assess and confirm within 10 business days.
- We aim to ship a fix within 90 days, sooner for anything exploitable by an opened file.
- We will credit you in the release notes unless you'd rather we didn't.
We do not currently run a paid bounty programme. We will not pursue legal action against good-faith research that respects user privacy, avoids data destruction, and gives us a reasonable window before disclosure.