Architecture
LidPush is a Tauri v2 desktop application with a React + TypeScript frontend and an embedded Axum (Rust) HTTP server. The Axum server starts on a random port every launch. The React frontend learns the port at startup via a Tauri IPC call (invoke("get_server_port")).
Every request to the internal API requires an x-lidpush-secret header containing a UUID generated fresh each session. This means nothing on the machine can accidentally or maliciously call the internal API without knowing both the port and the secret.
GitHub OAuth Flow
LidPush uses GitHub OAuth 2.0 for authentication. The flow works as follows:
- GET /auth/url — Opens the browser to authorize with GitHub.
- GET /auth/callback — Catches the OAuth redirect, exchanges the code for an access token, and stores it in Windows Credential Manager via the
keyringRust crate. - GET /auth/status — Checks whether a valid token exists in the credential store.
The GitHub token never touches the React frontend. It is stored in and retrieved from Windows Credential Manager exclusively through Rust code. The frontend only sees success/failure responses.
Token Storage
Your GitHub OAuth token is stored in Windows Credential Manager using the keyring crate. This is the OS-level credential store, not a file on disk. The token is scoped to the current Windows user and is not accessible to other applications or users on the same machine.
Internal API Endpoints
The Axum server exposes the following endpoints, all protected by the random port + one-time secret mechanism:
/auth/url— Opens GitHub OAuth authorization page/auth/callback— Handles OAuth callback, stores token/auth/status— Checks authentication status/github/repos— Lists user's GitHub repositories/push/start— Runs clean + git2 push pipeline/push/history— Reads push records from Neon DB
Cleaning & Push Pipeline
Before any push, LidPush copies your project to a temporary directory, then removes junk files. The cleaning logic handles dependency folders, build outputs, caches, lock files, OS junk, and compiled artifacts. It also scans text files for secret patterns including GitHub tokens, AWS keys, private key blocks, Stripe keys, Discord tokens, and generic API_KEY= patterns.
Your original folder stays untouched — all operations happen on the temporary copy. Git operations use git2-rs (libgit2), which means no separate Git installation is required.
Database Security
Push history and user records are stored in a Neon PostgreSQL database with SSL-required connections. The database contains only metadata — no file contents, no source code, no credentials.
Known Considerations
- Secret detection is a warning, not a block — the user can review flagged items before pushing
- OAuth client secret is embedded in the compiled binary via
.env - Database credentials are embedded in the Rust binary at compile time
Reporting a Vulnerability
To report a security issue, open a security advisory on GitHub ↗ or contact Lidprex Labs ↗.