You probably shouldn't be reporting bugs to him. He seems to think that his application is secure unless someone has pointed out a specific bug. I've already found almost half a dozen severe security

(Quote)

If you’ve identified a concrete XSS vector, please provide the exact file, code path, and a reproducible payload so it can be reviewed properly.

No executable update is downloaded, replaced, or executed automatically.

So, when it downloads an upload, that's just for fun and that update never gets executed?

Checking for updates or fetching version metadata is not the same as downloading and executing code.

You yourself told us it downloads updates:

To clarify one factual point:

You outright told us that it did.

To be clear and transparent:

Storage: 2x1.92TB NVMe or higher

Please point us to this documentation

For clarity, Marix is an open-source desktop SSH client, not a formally audited security product.

For transparency, Marix does not ship any custom networking or cryptographic stacks.

Please point us to this documentation

Claiming the author “doesn’t understand their own application” without pointing to a specific design flaw, code path, or reproducible exploit is not a technical argument.

If your position is that software cannot be considered safe unless it controls and documents the entire OS and browser networking stack, then no modern desktop application meets that bar.

(Quote)

Yes, we own the hardware and network.

Marix documents all application-level outbound connections that are explicitly initiated by its own code (e.g. optional version metadata fetches).