Account access
Verified email, HTTP-only session cookies, password controls, and server-side authorization protect publisher actions.
Private storage. Controlled delivery.
DistKit keeps production IPA and APK objects private and applies authorization or share-link policy before serving a manifest or package file. Security claims on this page describe implemented controls, not certifications.
Publisher or tester
Worker policy check
Private R2 object
Controls mapped to the action they protect.
The security model follows the account, record, object, link, and device data path.
Tenant records
Production data uses Supabase Postgres with row-level security; service credentials remain server-side.
Package delivery
IPA and APK objects are private in Cloudflare R2 and are served through Worker routes after account or share-link policy checks.
Public links
Password, expiry, delivery-handoff limit, enabled state, App status, and Release status are evaluated before delivery.
Device data
The explicit device flow returns the UDID, hardware model identifier, and iOS version. It does not enroll MDM, and its session expires after about 15 minutes.
Abuse response
Reports can be reviewed, links or Apps can be restricted, and moderation actions are recorded for investigation.
Security boundaries stay visible.
Accurate limits are part of the product contract.
DistKit does
Parse package metadata, enforce its own access policy, and keep IPA and APK delivery behind controlled routes.
DistKit does not
Re-sign packages, bypass platform policy, guarantee device eligibility, confirm completed installation, or claim certifications it has not earned.
Publisher owns
Apple certificates and profiles, Android signing keys, authorized distribution, export settings, and tester authorization.
Policies and operational access
Review the public policies or contact support before distributing sensitive builds.
Review the package before you publish.
Start with a signed IPA or APK and keep the Release private until its report and link policy are ready.