Authenticator stores your Riot Games two-factor authentication (2FA) secrets locally and encrypts them at rest using the operating system keychain (Windows DPAPI). Secrets are never transmitted to any server and never leave your device.

Please do not open a public issue for security problems. Instead, open a private report:

• GitHub Security Advisory: https://github.com/dancer/authenticator/security/advisories/new

We aim to acknowledge reports within 72 hours.

Your secrets never do. These are the only outbound connections the app makes:

• *.riotgames.com, for enrollment, factor status, registering this device for push, and sending an approve or refuse response.
• Google's Firebase Cloud Messaging, to receive login attempts as push. A build with no push identity never connects to it.
• auth.cryba.by, for the update feed and the installer.
• nominatim.openstreetmap.org, to turn the coordinates included in a login attempt into a city name for the prompt. Only those coordinates are sent, with no account identifier, and if it fails the prompt simply shows no location.

• TOTP seeds are stored encrypted (DPAPI) under your Windows user profile.
• Removing an account in the app stops local code generation but does not disable MFA on the Riot account itself.
• Keep an exported backup (optionally password-protected) so you can restore without re-enrolling.
• The updater fetches releases from https://auth.cryba.by. HTTPS is required for the feed, the download, and every redirect in between, and the installer is checked against the SHA-256 published in the feed before it is run. An update with no checksum, or one whose bytes do not match, is refused.
• Push approvals require an app identity that is not distributed with this project; see src/push-config.cjs. Builds without it fall back to codes.