Do not disclose a suspected vulnerability in a public issue. Use the repository's private GitHub security-advisory reporting feature. If that feature is unavailable, open an issue containing no sensitive details and ask the maintainers for a private contact channel.

RDPShift is a small wrapper around XFreeRDP. It does not implement an RDP session or authentication. Its custom network code performs only the initial RDP protocol negotiation and TLS handshake needed to retrieve the certificate fingerprint before credentials are requested. The real session is performed by FreeRDP and pinned to that fingerprint.

Credentials are collected in a transient Qt dialog and supplied to FreeRDP through an anonymous pipe. They are not placed in process arguments, profiles, logs, or regular files. They necessarily exist in both processes' memory while the connection is established.

Advanced connection options are session-only. Clipboard file transfer is off by default and requires explicit selection for each connection. No option is written to a profile or preferences file.

The trust database uses a keyed HMAC as the host-and-port identifier. The certificate fingerprint is encrypted using AES-256-GCM with the HMAC tag as associated data. The random root key is held in KDE Wallet.

• A process running as the same user while KDE Wallet is unlocked may be able to request the privacy key or inspect process memory.
• A privileged attacker can inspect memory, network state, DNS traffic, and the encrypted machine as it runs.
• The destination is necessarily disclosed to DNS infrastructure, network observers, and the remote service.
• Core RDP behavior, authentication, cryptography, and protocol compatibility remain FreeRDP responsibilities.
• RDP gateways, server redirection, and unusual load-balancing arrangements need additional testing and may not work with the current pinning model.

Do not use /cert:ignore as a workaround for a connection problem.