syncthing-security(7) on Linux
The text 1996d74193ee, as Debian 9 (Stretch) shipped it.
Security Principles Security is one of the primary project goals. This means that it should not be possible for an attacker to join a cluster uninvited, and it should not be possible to extract private information from intercepted traffic. Currently this is implemented as follows. All device to device traffic is protected by TLS. To prevent uninvited devices from joining a cluster, the certificate fingerprint of each device is compared to a preset list of acceptable devices at connection establishment. The fingerprint is computed as the SHA-256 hash of the certificate and displayed in BASE32 encoding to form a reasonably compact and convenient string. Incoming requests for file data are verified to the extent that the requested file name must exist in the local index and the global model. For information about ensuring you are running the code you think you are and for reporting security vulnerabilities, please see the official security page <https://syncthing.net/security.html>.